Vendor banking

Proof on each hop

1. 1. supplier-demo

   Ordinary vendor login.

2. 2. Object authorization

   A neighboring invoice id returned 200.

   host: vendors.northline.example
   account: supplier-demo
   request: own invoice id, then a neighboring id
   response: 200 with a different supplier's bank account
   account number: [redacted]
   Cloudflare: request allowed (no signature match)

   Fix. Authorize the invoice id against the signed-in supplier before returning payment details.

   Open weakness

3. 3. Vendor banking

   Payment details for a different supplier. Account number redacted.