Authentication and access release incidents

Authentication and access: 6 published incident types backed by 20 public reports.

The root-cause stage named most often in this group is code, in 5 of 6 incident types.

6 incident types published · 2 withheld · 20 public reports

Incident types in this group

Authentication and access


All sessions invalidated	Likelihood: medium (3 public reports in 5 years)	Impact: medium (3 of 3 reports: availability)	3
API key rotation breaks integrations	Likelihood: not published (1 public report in 5 years)	Impact: medium (2 of 2 reports: availability)	2
CORS policy blocks frontend	Likelihood: medium (3 public reports in 5 years)	Impact: medium (3 of 3 reports: availability)	3
Password reset link broken	Likelihood: low (2 public reports in 5 years)	Impact: medium (3 of 3 reports: availability)	3
Permission escalation via role change	Likelihood: medium (3 public reports in 5 years)	Impact: high (4 of 4 reports: data)	4
SSO login broken	Likelihood: medium (5 public reports in 5 years)	Impact: medium (5 of 5 reports: availability)	5

Withheld in this group: MFA bypass after flow change, Token expiry misconfigured. Reasons per route

Risk grid

Risk grid: count of incident types per likelihood and impact cell, from data/risk.json
Likelihood \ Impact	Impact: high	Impact: medium	Impact: low
Likelihood: high	0	0	0
Likelihood: medium	1	3	0
Likelihood: low	0	1	0
Impact unrated or likelihood not graded	1

Table equivalent: incidents per cell

Incident	Likelihood	Impact
All sessions invalidated	medium	medium
API key rotation breaks integrations	not-published	medium
CORS policy blocks frontend	medium	medium
Password reset link broken	low	medium
Permission escalation via role change	medium	high
SSO login broken	medium	medium

Root-cause stages

Stage	Incident types naming it
code	5
config	4
release-process	3
third-party	1
migration	1

Median time to detection across the group: 101 minutes from 4 reports that state both the change time and the detection time (values above the site-wide 95th percentile excluded).

Only on this page

API key rotation breaks integrations is the incident type in this group whose root causes do not include the code stage; its causes are introduced at config.

Group checklist

The first pre-release item of each published incident type in the group.

GR-01All sessions invalidated: Compare the hash of the token secret key in the release configuration with the one in production and block the release on any difference. config
GR-02API key rotation breaks integrations: Run the key cleanup job against a test key store seeded with old keys, keys created that day and keys marked to retain, and confirm only the old keys are disabled. integration
GR-03CORS policy blocks frontend: Run the login end-to-end test in a real browser from every production origin, including each custom domain, and confirm the console shows no CORS error. e2e
GR-04Password reset link broken: Request a password reset in staging, open the delivered email, follow its link, and confirm the reset form loads rather than the reset request screen. e2e
GR-05Permission escalation via role change: Run the team permission tests with every performance flag both on and off, and assert that a non-member sees zero rows from a private team in both states. integration
GR-06SSO login broken: Assert that the redirect_uri sent in the SAML init request, including host and query string, matches the value registered for each test tenant. e2e

Questions

What causes Authentication and access incidents?

Published incident types in this group name these root-cause stages: code (5), config (4), release-process (3), third-party (1), migration (1).

Which pipeline stage introduces most Authentication and access incidents?

The code stage, named in 5 of 6 published incident types in the group.

Which test classes catch Authentication and access incidents?

Test classes listed on the group's incident pages: end-to-end tests (4), configuration and environment tests (3), synthetic monitoring (3), integration tests (2), security tests (2), canary and progressive delivery checks (1), unit tests (1).

How quickly are Authentication and access incidents detected in public reports?

The median time to detection is 101 minutes across 4 reports that state both the change time and the detection time.

How likely are Authentication and access incidents compared with each other?

All sessions invalidated: medium likelihood, medium impact; API key rotation breaks integrations: not-published likelihood, medium impact; CORS policy blocks frontend: medium likelihood, medium impact; Password reset link broken: low likelihood, medium impact; Permission escalation via role change: medium likelihood, high impact; SSO login broken: medium likelihood, medium impact.

What should a release checklist for Authentication and access include?

The group checklist collects the first pre-release item of each of the 6 published incident types; each item names the test class that checks it.