Isolate Search Autocomplete by Tenant
Check suggestions and counts that appear before a full search result.
Autocomplete can reveal a private project name after only a few characters. Teams often test the full search results and miss suggestion services, recent-item lists, and facet counts. Those previews are data outputs and need the same tenant boundary. OWASP Multi Tenant Security applies to shared search services and caches.
Suggestion-source inventory
List every input to the suggestion panel. A single box may combine recent records, popular queries, people names, and external data. Record the owner and filter for each source.
| Source | Tenant owner | Visible data | Revocation rule |
|---|---|---|---|
| Recent records | Record tenant | Title and ID | Remove after access loss |
| Popular queries | Aggregate or tenant | Query phrase | Avoid private phrase leakage |
| People | Membership tenant | Name or email | Current role check |
| Facets | Search result set | Category and count | Same scope as results |
Do not assume that a label is safe because it lacks a record body. Names, counts, and timing can still reveal customer activity. If a suggestion is intentionally global, mark it as public and check that its source is public too.
Run a narrow fixture
Create synthetic A and B records with distinct prefixes. Query suggestions as A, B, a user in both, and a revoked A member. Check the response body and the UI cache. Warm the cache as A and repeat as B. Update and delete a record, then verify whether stale suggestions remain within the documented index delay.
The OWASP API Security Top 10 includes object authorization; this inventory extends the check to partial search outputs. Keep the test to owned data. If the source system has no tenant metadata, do not hide it behind a client filter and call the feature isolated. Add ownership at ingestion or remove the source from tenant-scoped suggestions.
Illustrative empty-query fixture: cache recent suggestions under verified tenant A, principal U1, and permission version 4. Warm it with A-marker. Request an empty query as B and require no A-marker. Revoke U1's A membership, advance its permission version, and require no old suggestion from either the API response or browser cache. Record the actual cache key and invalidation event; a tenant-only key may be too broad for private recents.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.