Cross-site scripting

The bare Todo API's list route calls table.scan() and returns every user's rows to an anonymous caller

Yvan Saf deployed the same serverless Todo API twice on one AWS account, once bare and once hardened, then attacked both from his own terminal. The bare list route reads the whole DynamoDB table because nothing in the request path knows who is calling.