You're viewing DevMetrics as HashiCorp. Only HashiCorp data is in this security context. The session BFF reads an HttpOnly cookie, not the request body.
Public product Customer view Internal view HashiCorp analytics
PRs merged …
Median PR cycle time …
Median time to first review …
Active contributors … Switch customer: HashiCorp · Prisma · Supabase · Temporal · Vercel
Tenant isolation Same dashboards. The BFF derives customerId from an HttpOnly cookie (customer) or sets skipTenantRls (internal). The forged body field is ignored.
Open a customer view first so the tenant cookie is set, then try forging another org id.
Customer Internal
Forged customerId in the request body vercel supabase prisma temporal hashicorp Internal operations · Public OpenDev