{"id":"data-isolation-gaps-parallel-access-control-gaps","text":"Two data-plane isolation gaps exist in the implementations: BCC recipients are stored alongside to/cc in the email record, which could leak BCC information to other recipients in a real system, and the presigned URL signing secret is generated once at class level rather than per instance, so all ObjectStorage instances in the same process share a single HMAC key — widening the blast radius if that key is compromised.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[{"type":"SL","antecedents":["email-service-bcc-stored-in-record","s3-presigned-secret-is-class-level"],"outlist":[],"label":"Security permissiveness extends beyond access control into data isolation — information leaks through stored BCC and shared secrets, not just through missing authorization checks"}],"dependents":["security-permissiveness-spans-policy-and-data-boundaries"],"metadata":{"last_reviewed":"2026-06-06T06:26:57","review_result":"invalid"},"created_at":"","updated_at":"","reviewed_at":"","verified_at":"","retracted_at":"","explanation":{"steps":[{"node":"data-isolation-gaps-parallel-access-control-gaps","truth_value":"IN","reason":"SL justification valid","antecedents":["email-service-bcc-stored-in-record","s3-presigned-secret-is-class-level"],"label":"Security permissiveness extends beyond access control into data isolation — information leaks through stored BCC and shared secrets, not just through missing authorization checks"},{"node":"email-service-bcc-stored-in-record","truth_value":"IN","reason":"premise"},{"node":"s3-presigned-secret-is-class-level","truth_value":"IN","reason":"premise"}]}}