Four Roles, One Marketplace, and the Flaw We Found Before Launch
An intermediated marketplace has four kinds of user who must not see each other’s data. A pre-launch audit found a public signup path that could become an administrator — before a single paying user existed.
Fashion and textile industry · intermediated B2B matching
fashion!The Need
Matching a fashion brand with a manufacturer is not a directory listing. The buyer describes what they need, suppliers respond with proposals, and a consultant sits between them shaping the brief and protecting both sides — which means four distinct roles with four distinct views of the same data, and strict rules about who may see a proposal, a price or a counterparty’s identity. Get the authorization model wrong and the platform does not merely leak data: it destroys the intermediation that is the reason it exists. A marketplace where a supplier can see a competitor’s bid, or a buyer can bypass the consultant, has no product left to sell.
The Approach
We built the platform around the four roles as first-class concepts — buyer, supplier, consultant and administrator — with a guided request wizard, a proposal flow and a supplier showcase, each rendering only what its role is entitled to. Then, before opening to paying users, we ran a full break-it audit across all four views rather than testing the happy path and declaring victory. It found a critical authorization flaw: the database trigger that provisions a new account trusted client-supplied metadata, so a public self-signup could assert an administrator role and take over any account. Two further paywall and authorization bypasses came out of the same pass. The audit verdict was recorded as not launch-ready, in writing, with the flaws ranked and the happy paths confirmed working — because the useful output of a security review is a decision about launching, not a reassurance.
