[Bug] Defensive security audit of my own local codebase reroutes off Fable 5
Bug Description
Defensive security audit of my own local codebase reroutes off Fable 5
▎
▎ I'm a founder auditing my own platform (Xingu, a CPMS). The repos are checked out locally at ~/Xingu/Engineering, in my own GitHub org, against my own AWS account. There is no remote target in the request — no IP, no
▎ host, no network action. It's static review of source files on disk, and the output is a list of things for me to fix.
▎
▎ Asking for a tenant-isolation audit reroutes me off Fable 5, which I'd selected, with a flagged-prompt message.
▎
▎ Prompt A (rerouted):
▎ "run an in-depth internal security audit for the identity, api and ocpp repo's. extra focus area is the tenant isolation, making sure tenants can not cross into each others data, users can not do unauthorized things when
▎ already authenticated like retrieving data that is not theirs. so focus in attacks coming from the inside, people who are already in, which can be deliberate or accidental."
▎
▎ Prompt B — removed the "attacks from the inside" clause, same result:
▎ "run an in-depth internal security audit for the identity, api and ocpp repo's. extra focus area is the tenant isolation, making sure tenants can not cross into each others data, users can not do unauthorized things when
▎ already authenticated like retrieving data that is not theirs."
▎
▎ Since B still trips it, the trigger appears to be the vulnerability class itself, not the framing — and you can't request a tenant-isolation audit without naming tenant-isolation bypass. So there's no wording that keeps
▎ the technical scope and avoids the reroute.
▎
▎ Suggestion: weight "target is local source on disk, no host named, no network action requested" as a signal separating audit from recon. The audit ran and found four critical authorization defects in my own code,
▎ including a full MFA bypass and a cross-tenant payment-webhook forgery. This is the use case the capability exists for.
Environment Info
- Platform: darwin
- Terminal: iTerm.app
- Version: 2.1.228
- Feedback ID: 743a7d8c-d37d-43e0-8fd2-07b9da4cd0fc
Errors
[]