Fixing Data Leakage: Filtering Inactive Records in User Profiles
One of the most subtle bugs you can encounter is a UI that displays information meant to be hidden. In the FotazaApp project, we recently discovered that user profile pages were exposing posts that had been marked as inactive or deleted.
The Discovery
While reviewing the data flow for user profile views, we noticed that the application was fetching the entire recordset associated with a user