Enforcing Bulletproof Tenant Isolation & IDOR Defenses in Multi-Tenant SaaS

Why AI coding tools introduce this vulnerability

// AI-Generated Document Fetcher (VULNERABLE TO IDOR)
export async function getInvoice(invoiceId: string) {
  // Only filters by invoiceId! Does NOT check tenant ownership!
  return await db.query('SELECT * FROM invoices WHERE id = $1', [invoiceId]);
}

export async function getInvoice(invoiceId: string, organizationId: string) {
  // CRITICAL: Always filter by BOTH object ID AND active organization ID!
  const res = await db.query(
    'SELECT * FROM invoices WHERE id = $1 AND organization_id = $2',
    [invoiceId, organizationId]
  );
  if (res.rows.length === 0) {
    throw new Error('Invoice not found or unauthorized');
  }
  return res.rows[0];
}