--- title: Hiding a Signup Button Isn’t Security: From Client-Side... description: A bug bounty investigation shows how a hidden signup button turned into a critical vulnerability chain. A frontend feature flag disabled the signup UI, but the... canonical: https://daily.dev/posts/hiding-a-signup-button-isn-t-security-from-client-side-controls-to-cross-tenant-data-exposure-1z7kwgxyj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hiding a Signup Button Isn’t Security: From Client-Side Controls to Cross-Tenant Data Exposure | daily.dev og:description: A bug bounty investigation shows how a hidden signup button turned into a critical vulnerability chain. A frontend feature flag disabled the signup UI, but the... og:url: https://daily.dev/posts/hiding-a-signup-button-isn-t-security-from-client-side-controls-to-cross-tenant-data-exposure-1z7kwgxyj og:image: https://api.daily.dev/og/posts/1Z7kwgxYj.png og:image:alt: Hiding a Signup Button Isn’t Security: From Client-Side Controls to Cross-Tenant Data Exposure og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hiding a Signup Button Isn’t Security: From Client-Side Controls to Cross-Tenant Data Exposure **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 10 min read · 0 upvotes · 0 comments ## Summary A bug bounty investigation shows how a hidden signup button turned into a critical vulnerability chain. A frontend feature flag disabled the signup UI, but the backend API still accepted registration requests directly. The API also returned a confirmation token in the signup response, allowing email verification bypass without mailbox access. Once authenticated, the tester found the user-update endpoint accepted an unprotected is_staff field, enabling self-service privilege escalation. With staff access, the tester enumerated users across tenants via a client-supplied domain_uuid parameter and retrieved API keys for multiple organizations through a domains endpoint. Individually each flaw seemed minor, but chained together they allowed an unauthenticated attacker to reach cross-tenant credential material. Remediation recommendations include server-side enforcement of registration rules, never returning confirmation secrets to unverified clients, protecting sensitive fields like is_staff from client writes, deriving tenant scope from authenticated identity rather than client input, and never exposing API keys in general list endpoints. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is hiding a signup button in the frontend not a real security control? Because a feature flag like USER_SIGNUP: false only affects the UI rendering, while the backend API can still accept direct POST requests to create accounts. A tester found that even though a client's login page had no visible signup option, the /signup route and the underlying /people/ registration endpoint remained fully functional, letting anyone register directly via the API. _Track write-ups like this on daily.dev to sharpen instincts for spotting client-side-only security controls._ ### How can an attacker escalate privileges through a mass-assignment vulnerability in a user PUT endpoint? By sending a PUT request to a user-update endpoint with an unauthorized field such as is_staff set to true, if the backend blindly accepts whatever attributes are included in the request body without checking whether the caller is allowed to change them. In one case, a normal authenticated user sent PUT /people/{uuid}/ with {"is_staff": true} and the server returned 200 OK, granting staff-level administrative access. _Developers hardening APIs against mass assignment can follow real-world breakdowns like this on daily.dev._ ### How can a client-supplied domain_uuid parameter break tenant isolation in a multi-tenant API? If the server trusts a domain_uuid value sent by the client instead of deriving the allowed tenant from the authenticated user's identity, an attacker can query GET /people/?domain_uuid=OTHER_TENANT_UUID and receive user data belonging to a different organization. In a documented case, a staff-level token obtained through privilege escalation was used this way to enumerate users across tenant boundaries and later retrieve domain API keys via GET /domains/. _Engineers designing multi-tenant systems can study attack chains like this on daily.dev before shipping tenant-scoped APIs._ ## Similar posts on daily.dev - [Your sign-up form is a weapon](https://daily.dev/posts/your-sign-up-form-is-a-weapon-cwnsa8fnc) · Hacker News · 0 upvotes · 0 comments - [How I Found an Email Verification Bypass on an AI Freelance Platform](https://daily.dev/posts/how-i-found-an-email-verification-bypass-on-an-ai-freelance-platform-u8qbqrzz7) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#multi-tenancy](https://daily.dev/tags/multi-tenancy) [View this post on daily.dev](https://daily.dev/posts/hiding-a-signup-button-isn-t-security-from-client-side-controls-to-cross-tenant-data-exposure-1z7kwgxyj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hiding a Signup Button Isn’t Security: From Client-Side Controls to Cross-Tenant Data Exposure","url":"https://daily.dev/posts/hiding-a-signup-button-isn-t-security-from-client-side-controls-to-cross-tenant-data-exposure-1z7kwgxyj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hiding-a-signup-button-isn-t-security-from-client-side-controls-to-cross-tenant-data-exposure-1z7kwgxyj"},"datePublished":"2026-09-02T05:54:30.354Z","dateModified":"2026-09-02T05:55:00.838Z","description":"A bug bounty investigation shows how a hidden signup button turned into a critical vulnerability chain. A frontend feature flag disabled the signup UI, but the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f594473e050dabf2bdba229aa83df327?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f594473e050dabf2bdba229aa83df327?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hiding-a-signup-button-isn-t-security-from-client-side-controls-to-cross-tenant-data-exposure-1z7kwgxyj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,multi-tenancy","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"Hiding a Signup Button Isn’t Security: From Client-Side Controls to Cross-Tenant Data Exposure"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hiding-a-signup-button-isn-t-security-from-client-side-controls-to-cross-tenant-data-exposure-1z7kwgxyj#faq","mainEntity":[{"@type":"Question","name":"Why is hiding a signup button in the frontend not a real security control?","acceptedAnswer":{"@type":"Answer","text":"Because a feature flag like USER_SIGNUP: false only affects the UI rendering, while the backend API can still accept direct POST requests to create accounts. A tester found that even though a client's login page had no visible signup option, the /signup route and the underlying /people/ registration endpoint remained fully functional, letting anyone register directly via the API. Track write-ups like this on daily.dev to sharpen instincts for spotting client-side-only security controls."}},{"@type":"Question","name":"How can an attacker escalate privileges through a mass-assignment vulnerability in a user PUT endpoint?","acceptedAnswer":{"@type":"Answer","text":"By sending a PUT request to a user-update endpoint with an unauthorized field such as is_staff set to true, if the backend blindly accepts whatever attributes are included in the request body without checking whether the caller is allowed to change them. In one case, a normal authenticated user sent PUT /people/{uuid}/ with {\"is_staff\": true} and the server returned 200 OK, granting staff-level administrative access. Developers hardening APIs against mass assignment can follow real-world breakdowns like this on daily.dev."}},{"@type":"Question","name":"How can a client-supplied domain_uuid parameter break tenant isolation in a multi-tenant API?","acceptedAnswer":{"@type":"Answer","text":"If the server trusts a domain_uuid value sent by the client instead of deriving the allowed tenant from the authenticated user's identity, an attacker can query GET /people/?domain_uuid=OTHER_TENANT_UUID and receive user data belonging to a different organization. In a documented case, a staff-level token obtained through privilege escalation was used this way to enumerate users across tenant boundaries and later retrieve domain API keys via GET /domains/. Engineers designing multi-tenant systems can study attack chains like this on daily.dev before shipping tenant-scoped APIs."}}]} ```