# Remediation record and regression evidence

Completed example — all product names, people, evidence IDs and results below are synthetic teaching data. They are not test results from this website or an assessment of a real product.

## Finding

F-104 affects LedgerDesk search r21 in authorized local testing with seeded invoices only. The invariant is that a search term changes values, never SQL structure, and results remain tenant-scoped. Searching for the literal value `' OR 1=1 --` returned rows outside the expected search and tenant filter. Confidence: reproduced in the supplied test database; production exposure has not been assessed.

## Cause and repair

The handler interpolated the search term into SQL before passing the string to SQLite. Replacing quotes or suppressing the error leaves a parser boundary problem. The repair uses a fixed SQL statement with bound search and tenant values. Allowed sort choices map to fixed SQL fragments because a parameter cannot choose an identifier. Both list and export use the repaired repository function.

## Regression matrix

| ID | Input | Expected response / effect | Before | After | Evidence |
| --- | --- | --- | --- | --- | --- |
| R-01 | Ordinary term rent, tenant north | Expected north rows only; no writes | Pass | Pass | run-22 |
| R-02 | Literal `' OR 1=1 --` | No matching seeded value; no rows from south | Fail | Pass | run-22 |
| R-03 | Sort value `amount; DROP TABLE invoices` | Validation rejection; table unchanged | Fail | Pass | run-22 |
| R-04 | Export same search inputs | Same tenant and value semantics as list | Fail | Pass | run-22 |

## Closure

Synthetic fixed revision r22, artifact D22, runtime Python 3.12 with SQLite version recorded in run-22. Local tests establish these cases only. Deployment observation is missing, so disposition is fixed in candidate, awaiting rollout verification. Release owner Ravi must confirm running D22, execute the read-only synthetic tenant smoke test and remove the temporary search restriction. Retest reviewer Jules closes only after that evidence is attached. No production rows or credentials belong in this record.