Robin Enterprise

1. Executive summary

Robin engaged Tecmie to independently verify an internal, AI-assisted security assessment of Robin Enterprise and to issue our own report. We reviewed all 27 findings against the source at both the assessed and remediated commits, reproduced the most serious ones against live instances, and formed our own view of severity. This report is our assessment, not a countersignature of Robin's.

We concur that the findings are real and that the remediations close them. One finding is a genuine High: an anonymous attacker could seize an invited account with no proof of mailbox control. The rest are authenticated-origin issues — a member or an organization administrator reading another workspace's private content or instance-wide data they should not see. Under the confirmed single-organization deployment, the workspace is the tenancy boundary, and several of these reads break the workspace-confidentiality guarantee the product is sold on. All 27 are fixed at 94610791, three with minor residuals noted below.

Where we differ from the internal assessment is severity, not facts. Robin's scoring multiplies any authenticated-origin finding by 0.2, which caps every insider finding at 4.4 and lands 21 of 27 as "Informational." We think that buries reads which cross a workspace boundary the product treats as a security boundary. We keep Robin's metric score for traceability and add a Tecmie severity for those findings, with rationale, in the register.

2. Scope and method

In scope: the server-side application, workspace packages, and configuration at the two commits — authentication and session handling, the authorization and tenant-isolation layer, the MCP tool surface, background workers, the LLM boundary, data lifecycle, and dependency and configuration posture.

Out of scope / not independently verified: the Next.js frontend beyond the published-wiki render sink; third-party dependency internals beyond version and reachability; production infrastructure and runtime configuration; and the 16 findings we did not reproduce live (we concur from source review, stated per finding).

Method. Source review at both commits, verifying each finding's cited code path and each remediation line-for-line; then live reproduction of the High, the four cross-workspace reads, the related enumeration finding, and the anonymous chain, against a running pre-remediation instance and a freshly built, migrated, and seeded 94610791 instance.

Severity. Robin's metric is retained as the "Assessed score." Tecmie severity is assigned on business impact under the single-org model, diverging only where the metric's attack-origin multiplier collapses a real cross-workspace exposure to Informational.

3. What we reproduced

Against a live pre-remediation instance and a fresh 94610791 instance:

Two honest limits on the pre-remediation side. TEC-003 could not be isolated as an escalation live, because the only administrator available is a super-admin who reads the private entry directly regardless; the remediation is nonetheless shown cleanly with an org-admin returning 404. TEC-005's disclosure needs a stuck signal in a foreign workspace, which we did not seed into a shared instance; its fix is confirmed positively on the fresh stack. Neither limit affects the remediation verdict.

4. Severity, and why we re-rated five findings

The product partitions an organization's knowledge into workspaces and enforces per-workspace membership; private workspaces keep board, HR, or deal material away from other members. Under single-org, a workspace is the security boundary that matters, and a member or admin reading across it is a real breach of the product's promise — even though no external attacker can reach it without an account. Robin's metric assigns such findings Attack Origin "Specific" (×0.2), which caps them at 4.4 and lands them at Informational. We rate on impact:

• TEC-003 → Medium. An org administrator reads the full captured content of any private workspace they are not a member of. High confidentiality, gated to org-admin.
• TEC-018 → Medium. Any member reads instance-wide usage_events — entry, wiki, and signal identifiers plus user ids across every workspace — the chain's key-harvest source.
• TEC-017 → Medium. Any member reads another workspace's signal taxonomy by entry key.
• TEC-004 → Low and TEC-005 → Low. Two access-control breaks Robin scored Informational: a member reaching an admin-only route, and an admin enumerating identifiers across workspaces. No record content, so Low — but control-bypasses, not informational notes.

We concur with Robin on the remaining insider findings and did not raise them; the critique is that the model buries the significant cross-workspace reads, not that every authenticated-origin item deserves a higher band. Nothing is raised to Critical: single-org removes the anonymous path that would make these arbitrary-origin. TEC-001 remains the single High on its own merits.

A fair counter-view: under a strict external-attacker threat model, insider findings are correctly low and Robin's bands are defensible. We give it weight, but the product is sold on workspace confidentiality, so we rate the cross-workspace reads on that promise and state the trade-off rather than hide it.

5. Remediation status

All 27 findings are closed at 94610791. Three carry residuals that Robin disclosed and we confirmed — non-blocking follow-ups:

• TEC-011 — the per-wiki structure-update path still reaches the template compile sink without the allowlist walk (pre-existing).
• TEC-014 — emitAuditEvent swallows insert errors, so an audit write can fail silently.
• TEC-019 — one native invite path still bypasses the application's invitation audit.

The two items open at Robin's first remediation pass — a 500 regression on aggregate spend (TEC-018) and a backlinks name leak (TEC-012) — are both fixed at 94610791, which we confirmed.

6. Findings register

Every finding, with Robin's metric score, Tecmie severity, verification method, and status. ↑ marks a Tecmie raise above the metric.

7. Limitations of this review

• Coverage. We reproduced 7 of 27 findings live; the other 20 rest on source review. The seven include the only High and every finding that crosses a workspace boundary in the reads we consider most material.
• Assessed-commit provenance. Robin's own runs used a private snapshot (e0326609) for the vulnerable side, asserted byte-identical to public 90c033b0 on finding-bearing files. We verified the finding-bearing excerpts against 90c033b0 directly; we could not verify byte-identity of the full snapshot, which is not on the public remote.
• Frontend, dependencies, hosted provisioning. Not assessed here, consistent with the internal assessment's own gaps.
• Not a penetration test of production. This is a source-and-reproduction review of the code at two commits; runtime configuration and infrastructure are out of scope.

Tecmie independent review. Verdicts reflect Tecmie's own source review at the two commits and live reproduction on 2026-09-08–09. Reproduction transcripts and the runbook that produced them are held with the reproduction package. This document does not cover runtime configuration, production infrastructure, or organisational processes except where evidenced in the repository.