Invental/Review lessons/Trust boundaries the server must hold

Trust boundaries the server must hold

An empty list must never mean everyone

Never let an empty list mean “everyone” on a path that sends secrets. When the selection is gone, fail closed and make the user choose again.

01 · Before and afterThe pattern

TypeScript
// before
const recipients = selected.filter(isStillMember);
return recipients.length ? recipients : [ALL_PROJECT_MEMBERS];   // empty -> everyone

// after
if (selected.length > 0 && recipients.length === 0)
  throw new BadRequestError("Recipients left the project; choose recipients again");

02 · Run it on your appThe check

In your app, can a filter that removes every recipient quietly turn into “send to everyone”?

If the honest answer is no or not sure, this is worth a look before it reaches production.

Want this checked on your code?

Tell us what you are building and what worries you. We match a senior reviewer to your code and confirm scope before anything starts.

— Get in touch
hi@invental.co ↗
— Or
— What to include

A link or short description of the code or system, what you want checked, your stack, and when you need the answer. No repository access is needed until scope is agreed.

— Or leave a note
We reply within one business day.