Security Lab · Admin Export (BFLA)

No function-level authorization on the unprotected deploy. Anyone who reaches it, or who tampers their session cookie to the admin id, exports every customer record including cleartext passwords and BVNs. Models the Sterling Bank middleware auth-bypass PII exfil. The protected deploy blocks both.