vulns.co
/
GKData.io MCP

Back to Checklists

Exports and webhooks

Exports and webhooks are delayed APIs. The job id, the file, and the callback URL each need an owner.

Tags: export, webhook, idor, jobs

Checklist

  • Who can start: Roles that can create an export or register a webhook, including roles the UI hides if the API still allows them.
  • Job ownership: Job id from account A, then status, cancel, and download as account B. Both accounts must be yours. Compare status and body.
  • Download link: App download, email, or object storage. Note whether the link works after logout and whether it is tied to the creator.
  • Row scope: Folder, org, or search filters. A filter that exists in the UI but not in the job body is the result.
  • Callback target: Scheme and host rules for the webhook URL. A callback to an address you own shows delivery. Do not point it at internal networks.
  • Signing secret: Header, timestamp, and where the secret is stored. Another user you control should not be able to read that secret.
  • Event mix: Events from org A should not arrive at a webhook in org B. A deleted subscription should not keep receiving retries you can read.
  • Delivery logs: Logs and retry bodies. They should not contain another tenant's payload or a callback URL with embedded credentials.