A demonstration route that handed out a working session
One console endpoint was public with no production gate and returned a PM access token to anyone who could reach the origin. Its sibling already carried the gate, which is what made it dangerous.
POST /v1/console/session was marked public: true with no production gate. It seeded a demonstration project and returned a working access token for a project manager identity to any anonymous caller. No credential. No multi-factor step. To anyone who could reach the origin.
It was demonstrated against a running server before it was closed, rather than reasoned about: the token authenticated subsequent requests, and was stopped only by the role check on the particular command tried next. Which is to say it was stopped by luck of which button got pressed first.
The detail that matters is the sibling. /v1/console/identities already carried the production gate. That is what made this the dangerous kind of hole rather than an obvious one — the pattern looked handled. Anyone reviewing the file would see a gated demonstration route and move on.
Nothing in the interface called it at all. The console signs in through /v1/auth/login and /v1/auth/mfa/verify like any other client. The route existed for a demonstration that had long since stopped needing it, which is the usual biography of this kind of defect.
Writing the test found a second problem underneath it. The production check read a value snapshotted at import, so a test could not exercise the gate at all — the branch deciding whether an anonymous caller receives an access token was the one branch nothing could reach. A security gate nobody can test is a security gate nobody has checked.
It now reads the environment fresh, and the test drives both sides of it.