Loading SaaS Tenant Isolation Leakage Lab...

Use this when

You ship multi-tenant SaaS features with API routes, RLS, service roles, cache keys, search indexes, exports or storage paths.
You need to prove tenant A cannot see tenant B data before a release, migration, admin workflow or background job goes live.
You want a redacted test packet engineering, security, support and product teams can review without private data.

Boundary

It analyzes redacted architecture rows; it does not inspect source code or production data.
Verify with code review, real negative tests, database policy, logs, object rules and authorization checks.
Do not paste customer data, secrets, real tenant names, access tokens or private incident details.

Why this is different

Many SaaS leaks do not start with exotic exploits. They start with one cache key missing tenant ID, one support export trusting a form field, one worker job trusting payload tenant_id, or one service-role query without an explicit tenant predicate. This lab turns those hidden release risks into a boundary map and two-tenant test plan.