Design system

Ported components

A card, the four severity chips, and an evidence block — rendered from the byte-verified hattest-design.css.

High

Anyone with the link can read your users table

The listing endpoint returns every row without an auth check. Shown below is the raw response for an unauthenticated request.

GET /rest/v1/users?select=email,role
200 OK

[{"email":"amy@acme.test","role":"admin"},
 {"email":"joe@acme.test","role":"member"}]

Severity scale (findings only — never indigo):

HighMediumLowInfo