Jawetzel LLC

Security Review · redacted

A severe data exposure at a mid-size B2B distributor, found and reported for free.

A zero-knowledge review of a mid-size B2B distributor: what I found, how I disclosed it, and the patterns every company should know.

14

unauthenticated admin dashboards

~45,000

products with wholesale cost exposed

~2,900

customer payment records served anonymously

60+

employee names with phone extensions leaked

The short story

Early 2026 I was in talks with a mid-size B2B distributor about a contract. Looking over their site, something caught my eye and I poked at it. One issue turned into several, then into enough that they needed to know.

I wrote it up as a full report and sent it over. What follows is that report, with every identifying detail stripped.

The patterns

Six ways a company accidentally hands out its own data.

Every finding in the report maps to one of these. None of them are exotic. They are the same mistakes that show up on almost every review of a company that hasn't had one before. If any of these match how your team works, it's useful to know.

Unlocked internal dashboards

What
Internal tools built for employees that are accidentally reachable by anyone who knows the URL.
Why it matters
Every dashboard that was supposed to be internal becomes public. Customer lists, financial data, and operations data are available to anyone who finds the URL, without any actual breach.
How to spot it
Ask your team which internal pages require a real login and which rely on not being linked from the homepage. Pages in the second group are the ones at risk.

Guessable customer document URLs

What
Customer-specific files (statements, invoices, receipts) stored where anyone with the URL can download them.
Why it matters
One exposed URL means every customer's file is exposed, because the URLs follow a predictable pattern. An attacker with a small script can collect them all overnight.
How to spot it
Have a customer click "view my statement," then open the URL in an incognito window with no login. If the document still loads, the issue is present.

Hidden-in-the-UI data leaks

What
The screen shows "hidden" or "—" where sensitive data should be, but the underlying data shipped to the browser still contains the real values.
Why it matters
Any engineer, competitor's engineer, or curious customer with browser developer tools can see everything the UI is hiding.
How to spot it
Ask an engineer to open your site as a logged-out visitor and inspect what the server sends. If the payload matches what a logged-in user sees (just visually masked) the protection is only cosmetic.

Admin pages in Google results

What
Internal admin URLs show up in public search engines because nothing tells the crawler to skip them.
Why it matters
Attackers don't have to guess where your internal tools live when the sitemap already lists them.
How to spot it
Search Google for site:yourdomain.com. Any internal-looking page that appears is a potential problem.

Architecture secrets in plain sight

What
Vendor names, server names, API keys, and system details embedded in what gets shipped to every visitor's browser.
Why it matters
Each detail is a clue for an attacker. A vendor name points at which known vulnerabilities to try. Server names reveal topology. API keys can be used directly.
How to spot it
Ask a trusted outsider to view the page source on your homepage and flag anything that looks internal, including names, hostnames, and long random strings.

Missing browser-level protections

What
Standard protective settings that modern browsers honor when servers request them. In this case, the server is not requesting them.
Why it matters
On their own these settings don't cause a breach, but they limit the damage when something else goes wrong.
How to spot it
Use securityheaders.com against your URL. Anything below a B indicates that nothing is configured.

The deliverable

The redacted report.

This is the deliverable I sent, redacted so nothing identifies the company and nothing here points at a live system. The full version ran about 30 pages.

Download PDF

Security Audit — [company]

Date: Early 2026 · Type: Non-intrusive public information review

What was exposed

Using nothing but a web browser — no credentials, no insider knowledge — the following was publicly accessible on [company]'s website:

  • Warehouse inventory layouts showing where widgets, consumable widgets, and hazardous widgets were stored, with real-time headcount of who was on each floor.
  • 60+ employee names with direct phone extensions, which is everything a social-engineering attacker needs to impersonate staff.
  • A list of customers, their contacts, and their financial information, served to the public both through the web app and through a public file-storage bucket.
  • Live inventory counts for ~45,000 products, enough for a competitor to track stock levels in real time.
  • ~8,500 invoices, ~2,900 payment records, and the wholesale cost of every product in the catalog.

All of it reachable with no login and no authentication check.

How it happened

Three patterns accounted for most of the findings:

  1. Internal dashboards reachable without a login. Pages built for employees carried no authentication check, and search engines had indexed some of them, so they surfaced in public results.
  2. Customer documents in public storage with guessable URLs. Statement PDFs were generated on demand and parked on a public bucket with the customer ID in the filename, so one URL gave away the pattern for every other customer's file.
  3. Server responses that contained the data the UI hides. The screen showed "—" and "hidden," while the underlying response shipped to the browser in full.

Severity summary

  • High4 findings

    Unauthenticated internal dashboards · customer documents on public storage · product & pricing data leaked in-page · internal paths indexed by search engines

  • Medium3 findings

    Employee PII + live call availability · warehouse layout with regulated-inventory locations · live call metrics auto-refreshing

See Internal pages exposed and Data leaks for the drill-down. Scope covers what was and was not examined.

No pitch

Do any of these patterns sound familiar in your stack?

I'm happy to talk through what to look for or how to triage something you already found. No invoice and no sales pitch attached.

Book a call