carlos / platform Public

Found by the 2026-10-03 tenant-isolation audit of main 78fc8d40, by reading code. Each of these is small, and they share one theme: an app or a membership ends, and something keeps working for the wrong party.

1. Purge leaves credentials behind. PurgeAppRow (store.go:1488-1508) deletes neither cli_tokens nor door_keys. A later app with the same name in that account inherits them. MoveApp (store.go:1713) checks only service-name collisions, so stale tokens bound to that name in the destination account start reaching the app that moved in.
2. Purge leaves ledgers behind. release.PurgeApp sweeps apps/<acct>/<app>/ only (release/trash.go:182+); ledgers/<sqid>/<app>/ (ledger/ledger.go:55) is never swept. A new app with the same name inherits them, and the edge keeps serving them if the old manifest said public:true (edge/status.go:224-270).
3. A removed member can still revoke legacy app tokens they minted (authcli.go:1442-1500, RevokeCLIToken(addr,id)), which takes those services down. This is documented but still crosses a boundary.
4. Accepting an invite is a plain GET with no confirm step (console/server.go:2178-2204), and the handler also calls SetLastAccount. A top-level navigation passes SameSite=Lax, so a crafted link silently adds the victim to the inviter's account and makes it their current one.
5. Fleet names are one global namespace (console/fleets.go:200-207). "That name is taken" confirms another account uses a name and lets anyone squat it. Later operations are owner-checked correctly.

Fixes are going on a branch from this session.