The setting
buys homes from sellers, prepares them, and resells them. Its offers those homes through online listings, with licensed real estate professionals who work with buyers' agents from offer to closing.
A larger batch of document requests meets a WAF limit that still protects other operations.
Buyers need inspection documents together, while the gateway must keep rejecting unrelated oversized requests.
Who you’d be doing this for
“My agent asked which repairs we're requesting tonight, and I've been opening the documents one at a time.”
Niels Makinen · Home buyer · a character in this brief
Reviewing inspection documents before sending repair requests through a buyer's agent.
What is at stake
Buyers encounter errors on 6% of requests for inspection documents. You must weigh a narrow WAF exception against changing how the application batches requests.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- complete document access vs. perimeter coverage
- a scoped exception vs. application complexity
- request success vs. gateway latency
Why Opendoor
Inspection documents feed repair negotiations on company-owned homes, so a blocked request interrupts an active purchase decision.
Written with these in mind
Not your kind of problem? 18 more at Opendoor, or browse every organization.
Where the organization context comes fromThe postings this brief was written from, and the reporting read before it.
The organization context comes from public information. The situation and characters are written for the brief.
Job postings it was written from
Public descriptions of the work at Opendoor. They are listed as sources, not as openings. The lines under a posting are its own words, where it meets this brief.
- Application Security Engineer (opens in a new tab)
- Partner with engineering teams to harden authentication, authorization, and input validation across our codebase and production services, including the GraphQL gateway (Apollo) and our Kubernetes workloads - while driving a shift-left strategy that catches vulnerabilities before they ship.
- Scope and run internal security testing, red team exercises and adversarial analysis of our highest-risk flows ensuring findings directly harden detection and response.
- Infrastructure Security Engineer (opens in a new tab)
- Own the security architecture of our production cloud environment - AWS at the core, spanning multiple accounts, Kubernetes clusters, Terraform-managed infrastructure, and the identity plane that ties everything together.
- Open source contributions to cloud security tooling (Cartography, Prowler, ScoutSuite, Falco, Kyverno, Open Policy Agent, Checkov, etc.).
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.
Where similar work appears
Other live briefs connected to this one, and what connects them.
Similar problems at other organizations
Like this one, each of these turns on moving faster inside a system others depend on.
Valid group-management requests are failing 7.8% of the time after the inheritance release.
You must restore the admin flow without weakening the access boundary.
Other problems with a similar purpose
In each of these, as in this one, the aim is to remove a real security exposure while keeping the everyday workflow people depend on running smoothly.
Staged testing shows a 0.6% session failure rate on older mobile versions before an irreversible authentication cutover.
You need to close the token exposure without locking members out of liquidity and repayment flows.
One authentication mode has a confirmed flaw and has to be off in every managed workspace within 21 days.
You have to sequence migration and enforcement so exposure closes without breaking data delivery.
Valid workspace members are looping through sign-in despite appearing in the right SSO groups.
You have to restore access while preserving the permission boundary administrators rely on.
