Historical credit-authorization incident

The public summary as JSON. These are the same reviewed fields shown in Read.

{
  "schemaVersion": 1,
  "publicSummaryVersion": "2026-09-30",
  "classification": "PUBLIC",
  "title": "Historical credit-authorization incident",
  "summary": "The incident record describes a defect, present from 31 August 2026 and found on 16 September, that allowed a signed-in customer to alter its own credit balance. The 17 September record reports passing laboratory checks for a correction that restricts credit changes while preserving legitimate purchases and ledger reads. It explicitly leaves production deployment verification and ledger review as follow-up work in this version. The record does not establish whether customers misused the defect. Production follow-up belongs to separate later evidence; this historical disclosure is not proof of current exploitability.",
  "date": "31 August 2026",
  "scope": "Historical record; any production observation is limited to the dated test described below.",
  "result": "The incident record describes a defect, present from 31 August 2026 and found on 16 September, that allowed a signed-in customer to alter its own credit balance. The 17 September record reports passing laboratory checks for a correction that restricts credit changes while preserving legitimate purchases and ledger reads. It explicitly leaves production deployment verification and ledger review as follow-up work in this version. The record does not establish whether customers misused the defect. Production follow-up belongs to separate later evidence; this historical disclosure is not proof of current exploitability.",
  "sections": [],
  "currentDeployment": "Not independently verified by this historical evidence.",
  "canonical": "/evidence/inc-2026-09-17-credit-mint-route"
}

Download this public summary

This derivative has its own digest. It is not the original transcript or a new test. Historical original records are preserved privately.

Download public JSON →

SHA-256 5afd378db114c26c8f4e3bc2b173e82ee96d6b652ed1f1ba24f9fc7a0c33e3cc