SecurityInnovation/TMContentReview — Issue #201: Security Decisions are Not Made Based on Client-Accessible Parameters
Author: SergeTruth
Created: 2011-11-07 23:27:41+00:00
State: open

"Verify that all exceptions have been marked. Ensure that all exceptions to this rule have been previously marked as such in your application's documentation. Ensure that your application's development team is aware of any unmarked exceptions."
I am not sure when allowing security decisions based on client-accessible parameters would be warranted.