Two endpoints were found by hand that let anyone read or change other people’s data — a cart anyone could read, add to or delete from, and a compliance route that handed over any brand’s wholesale prices. Finding them was luck, so all 677 API routes were scanned for the same shape. The catalogue route was returning any brand’s full cost base to anyone who asked and accepting product rows from anyone at all; the upload route accepted anonymous files at any path and would overwrite what was already there; the activity log took the operator id from the request, so anyone could award themselves contribution points or write history against someone else’s name. Those are closed. A new build gate now fails on any route that holds the privileged database key, writes, and never establishes who is calling — so the remaining backlog can only shrink, and it is listed by name rather than hidden in a hash file.