← Samsara
First-time day at Samsara

Close the location IDOR in alert requests without delaying live updates

You’re the security / reliability engineer. Your team is in the room. Printed Oct 15, 2026.

Incident visibility is essential, but location access must remain scoped to the right worker.

Safety managers need current incident context while workers need their location protected from unrelated accounts.

Who you’d be doing this for

“I had to explain why someone could see a worker they weren't responsible for, during an active alert.”

Kamsiyonna Traore · Safety Manager

Uses incident-location context to coordinate help for isolated workers.

What is at stake

An authenticated account can retrieve another worker's incident location by changing an identifier. You must weigh a strict authorization check against uninterrupted incident updates.

Why it isn’t already fixed

Every obvious fix costs something else. That’s the part you’d have to decide.

  • location privacy vs incident visibility
  • fast containment vs durable authorization
  • release continuity vs regression coverage

Why Samsara

Worker Safety incident response depends on trusted location context when isolated workers need help.

Written with these in mind

application security engineersite reliability engineerproduct security engineer

Not your kind of problem? 15 more at Samsara, or browse every organization.

This is the setup. The work is inside.

Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.