Retrieval with no per-customer filter
HighAV-DATA-007PermissionsCore packNew in 2.0
What it finds
The app has multiple customers (tenant/org IDs) but searches the vector store without filtering by customer.
Why it matters
Retrieval returns the most similar documents from the whole index — including other customers' private files — and the model will happily quote them.
What an attacker could do: One customer could see another customer's documents in an answer.
How to fix it
Filter every retrieval by the signed-in tenant (metadata filter or a separate namespace per tenant), enforced server-side.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- RAG_NO_TENANT_FILTER
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM06 - Sensitive Information Disclosure
- NIST AI RMF
- MS-2.10, GV-4.1
- SOC 2
- CC6.1, C1.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Overly broad cloud IAM permissionsAV-PERM-003 · Critical
- AI workflow checks out untrusted PR code with secretsAV-PERM-007 · Critical
- Agent's Kubernetes account has cluster-adminAV-PERM-008 · Critical
- No permission or tool scope declaredAV-PERM-001 · High
- Unscoped delegation detectedAV-PERM-002 · High
- LangChain SQL agent with unrestricted database accessAV-FW-002 · High