Run the complete security acceptance test

Test least privilege, tenant isolation, CSRF, tokens, hashes, encryption, SSRF controls, headers, rate limits and audit. The guide then takes you through the correct route, the checks to complete before making changes, the workflow in order, and the evidence to review afterwards.

What you’ll accomplish

Test least privilege, tenant isolation, CSRF, tokens, hashes, encryption, SSRF controls, headers, rate limits and audit. This section provides a safe diagnostic order and states every important limitation found in the supplied version 1.0.0 UI/code.

Follow these steps

1. Go to Relevant Enterprise POS or /shop page and open the workflow that matches “Run the complete security acceptance test”. Confirm the page or record context before making a change.
2. Reproduce the issue with the exact tenant, role, route and input.
3. Check activation, permission and settings first.
4. Check the relevant record status and validation rule.
5. Check whether the transaction committed before retrying.
6. Use audit, order, movement, payment, webhook or host mail evidence.
7. Correct only the affected module configuration/data through supported UI/lifecycle actions.
8. Retest the original and neighbouring workflows.

Fields and options to review

• Guide focus: Test least privilege, tenant isolation, CSRF, tokens, hashes, encryption, SSRF controls, headers, rate limits and audit.
• Module activation and capabilities
• Tenant and location/register/shift state
• Product and stock eligibility
• Order/payment/fulfilment status
• Idempotency and rate-limit state
• Email/API/webhook dependencies
• Audit correlation evidence

Rules the system enforces

• Validation errors are designed to preserve transaction consistency.
• Failed transactional writes roll back rather than leaving partial balances.
• A missing UI is not proof a schema field is safe to edit directly.
• External payment refunds remain outside the module.

How to confirm it worked

• The specific outcome described by this guide is visible and remains tenant-scoped.
• The original workflow succeeds without changing unrelated CRM behaviour.
• No duplicate order, stock movement, return or webhook delivery is created.
• Existing help-centre and module assets remain intact.

Safety checks and troubleshooting

• Never bypass permissions, CSRF, tenant filters, idempotency or rate limits.
• Never patch core/vendor/theme files to solve a module-specific problem.
• Keep exact evidence before retrying financial or stock transactions.

Continue with related guidance