The setting
buys homes from sellers, prepares them, and resells them. Its offers those homes through online listings, with licensed real estate professionals who work with buyers' agents from offer to closing.
The closing cutoff arrives before the document queue can be fully trusted.
Holding deliveries protects buyer information, while releasing them protects scheduled closings.
Who you’d be doing this for
“My agent says the documents haven't arrived. I've already booked the movers, and nobody can tell me whether tomorrow still works.”
Miroslav Babic · Home buyer · a character in this brief
Waiting for the document delivery needed to keep a scheduled closing.
What is at stake
A compromised identity puts 86 buyers' closing deliveries on hold. You must weigh which document bindings you can prove against a cutoff that will pass before the full investigation ends.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- buyer confidentiality vs scheduled closings
- narrow containment vs shared workload continuity
- package-level proof vs incomplete application records
- evidence preservation vs automated remediation
Why Opendoor
Apollo GraphQL authorization records and S3 document access must agree before resale closing documents reach outside recipients.
Written with these in mind
Not your kind of problem? 18 more at Opendoor, or browse every organization.
Where the organization context comes fromThe postings this brief was written from, and the reporting read before it.
The organization context comes from public information. The situation and characters are written for the brief.
Job postings it was written from
Public descriptions of the work at Opendoor. They are listed as sources, not as openings. The lines under a posting are its own words, where it meets this brief.
- Application Security Engineer (opens in a new tab)
- Partner with engineering teams to harden authentication, authorization, and input validation across our codebase and production services, including the GraphQL gateway (Apollo) and our Kubernetes workloads - while driving a shift-left strategy that catches vulnerabilities before they ship.
- Application security or software engineering experience with a security focus, with strong skills in at least one of Python, Go, TypeScript, or Ruby, and the ability to read and write code across the others.
- Infrastructure Security Engineer (opens in a new tab)
- As our Infrastructure Security Engineer, you'll own the security of everything Opendoor runs on including multi-account AWS, Kubernetes clusters, the identity plane connecting every system, and the cloud workloads behind home acquisition, resale, mortgage, title, and escrow.
- Evaluate, build out and operate our cloud security visibility and protection platform ensuring it’s deeply integrated into engineering workflows to drive the automated remediation of infrastructure risks.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.
Where similar work appears
Other live briefs connected to this one, and what connects them.
Similar problems at other organizations
Like this one, each of these turns on crossing a deadline that can't be undone.
Repository paths from one organization appeared in another organization’s support export.
You must weigh immediate containment against preserving evidence and active agent work.
27% of payment workers still pull credentials from the legacy path, and the generated dependency maps list consumers with no owner.
You have to decide how much of that evidence to trust before the old path is turned off.
A customer's key destruction puts 2.4 million document versions beyond recovery tonight.
You must weigh permanent research loss against carrying disputed permissions into the only readable copies.
