build2 distinct publishers
A missing ownership check on cancel turned one gym member's assistant into an intruder
The booking software's cancel endpoint never checked who owned the reservation, so an assistant acting for one member erased another member's place and could not restore it. That exposure belongs to the product team.
Reality
- Evidence74
- Adoption