Moving an application to serverless removes a lot of infrastructure work. It does not remove the need to decide who can access each piece of data.

A valid login can coexist with a serious authorization flaw. That makes a small notes application an interesting way to explore AWS Continuum: can security tooling connect a mistake in application code with its actual impact?

This is a project idea I would like to explore, rather than a lab I have already built. I have not put it into practice yet because of the potential costs, particularly for Continuum’s code vulnerability analysis. The architecture and testing workflow below are a proposal; I do not have deployment results, confirmed Continuum findings, or remediation outcomes to share at this stage.

A login is only the beginning

Imagine two users, Alice and Bob. Each can create and read private notes.

Alice signs in and requests GET /notes/alice-note-id .…