SportsYard ERPNext Audit Review

How to use this page

Each tab covers one audit area. The number on each tab is how many findings it holds. Every finding appears in exactly one tab; other places link to it by its ID (SY-xx).
Each finding card follows the same order: Issue, Why it matters, Evidence and code, Suggested solution, Status or dependency.
Severity is how serious the effect would be. Confidence is how sure the audit is: Confirmed means seen in the code or in production; Likely means strong evidence that still needs a check in production.
Use All findings to search by ID or keyword and filter by severity, area, phase or quick wins.

Source files: audit_report.md, security_alerts.md, technical_audit_report.md, code_and_integration_assessment.md, integration_assessment.md, risk_register.csv, recommendations_roadmap.md, evidence_index.md, customisation_inventory.md, functional_flow_guide.md, business_questions.md, data_request_list.md, handoff_inputs.md. All are Agilitas Confidential.

The short version

SportsYard's ERPNext keeps the retail books: about 4,000 store sales a month arrive from ADP, and purchasing runs through a detailed approval process. The audit found three access problems that let outsiders, or any staff user, reach much more than they should (SY-01, SY-02, SY-03). All three can be contained this week through settings, without new code.

The second theme is stock values. ERPNext is constantly recalculating them because store sales arrive on average 1.9 days late. This is standard ERPNext behaviour, but the SportsYard set-up makes it heavier: 28,382 recalculations, 5,150 of them failed (SY-05).

The audit records 68 findings, of which 49 are quick wins. The counts below are counts of findings, documents and events. No financial loss has been measured.

Findings by severity and confidence
Severity	Confirmed	Likely	Potential	Total
Critical	3	–	–	3
High	13	2	–	15
Medium	25	4	3	32
Low	12	1	–	13
Info	5	–	–	5
Total	58	7	3	68

Findings by area

Security 20 3 Critical · 5 High · 10 Medium · 1 Low · 1 Info
Stock, accounting and data 14 4 High · 7 Medium · 3 Low
Integrations 18 3 High · 9 Medium · 4 Low · 2 Info
Performance and reliability 6 3 High · 2 Medium · 1 Low
Code and configuration 10 4 Medium · 4 Low · 2 Info

Ten things to know

A no-login web address prints any document as Administrator (SY-01). The same weakness exists on the Distribution system.
The AI assistant lets every user run their own code on the server, and it has been used 552 times (SY-02). Anyone can also register an app against it (SY-37).
Guests can attach files to any record, and a customisation then disables the supplier or overwrites product photos (SY-03).
ADP creates 99% of all invoices through the general-purpose API, with no duplicate check, no date check and no reconciliation (SY-08, SY-30, SY-46).
Late store sales drive 28k stock revaluations; a database script and a customisation make it worse (SY-05, SY-06, SY-07).
Three customisations save half-finished work (SY-09, SY-10, SY-11).
The PO grand total is replaced by the cash-discount amount; Finance should confirm whether that is intended (SY-12).
The invoice CSV e-mail fails for almost every store sale: 1,234 errors in 15 days (SY-04).
No deadlocks were found in the retained error log, and no SQL injection was found in the code.
About 840 custom fields and 300 form settings exist only in the live database, and every push to the main branch deploys straight to production (SY-27, SY-26).

What the audit covered

The SportsYard custom app (erp_sportsyard, the only custom software), its integrations, and the settings and customisations stored in production. The code was read at the version on the main branch (29 Sep 2026) on a workstation matching production exactly (Frappe 15.118.0, ERPNext 15.119.1). Production was examined read-only on 12 Nov 2026: counts, settings and error summaries. Nothing was changed, and no customer or business records were exported. Business process, hosting, disaster recovery and cost of ownership are covered by other workstreams.

Security

Who can reach what. These findings cover web addresses that need no login, user permissions, the AI assistant, uploaded files and keys.

SY-01Security

Anyone can download a PDF of any document without logging in

Severity CriticalConfidence ConfirmedRisk 15 · ExtremeLikelihood LikelyPhase 1 · Effort SQuick win

Issue

get_pdf is allow_guest, performs no signature check, sets frappe.session.user = 'Administrator' and returns download_pdf for any caller-supplied doctype/name. Session switch does not persist beyond the request (G-SA01 detail).

Why it matters

Anyone on the internet can download invoices, POs, supplier and payment documents by guessing sequential names.

Evidence and code

Observed

erp_sportsyard/utils/workflow_action.py:244-253

Confidence

Confirmed (code); deployed commit unverified

Excerpt from erp_sportsyard/utils/workflow_action.py, lines 248-253

@frappe.whitelist(allow_guest=True)
def get_pdf(doctype, name):
	frappe.session.user = "Administrator"
	doc = frappe.get_doc(doctype, name)
	print_format = doc.meta.default_print_format or "Standard"
	return download_pdf(doctype, name, format=print_format)

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Needs confirmation in production (see the data request list). Compared with the Distribution audit: Distribution SA (pim_agilitas workflow_action.py:266-271): Confirmed, same code copied Review-pass sources: SA-SY-01

SY-02Security

Every assistant user can run their own Python code on the server

Severity CriticalConfidence ConfirmedRisk 15 · ExtremeLikelihood LikelyPhase 1 · Effort SQuick win

Issue

The subprocess is a resource limiter (CPU and memory), not a security boundary. The user's code runs with: frappe.get_all and frappe.get_doc, which skip permission and user-permission checks, so it can read any table; frappe.conf, which holds the DB password and encryption key, so it can decrypt every Password field and every API secret; write paths: frappe.get_doc(...).save/submit/delete, frappe.db.sql(variable) followed by frappe.db.commit(); process execution, for example through frappe.get_attr("subprocess.run") or _posixsubprocess, with the bench Unix user's rights.

Why it matters

Any internal or vendor user with desk access can read all financial, supplier, bank and employee data, change ledgers without an audit trail, steal integration credentials (Olabi, ADP, India Compliance, bank H2H) and take over the server. Assistant Audit Log keeps the code, but a malicious user can delete that log too.

Evidence and code

Observed

frappe_assistant_core/utils/code_execution_subprocess.py: :293-307: sandbox globals include "frappe": frappe. Only the separate db name is the ReadOnlyDatabase wrapper. :437-440: a fresh frappe.connect() as the user. :473: exec(code, execution_globals). :184-189: the restricted import allows any root module starting with _, for example _posixsubprocess. :232: getattr is exposed. frappe_assistant_core/plugins/data_science/tools/run_python_code.py: :49: requires_permission = None. :746-782: the "security scan" is a regex blacklist. It blocks db.sql("DELETE… only when a string literal follows directly, and db.set_value(. It does not block frappe.get_attr, frappe.get_all, frappe.conf, frappe.set_user, frappe.db.commit, .delete() or frappe.get_doc(...).save(). frappe_assistant_core/core/tool_registry.py:431-436: no permission check when requires_permission is None. utils/migration_hooks.py:990, 1014: tools default to "Allow All". patches/v2_1/update_assistant_enabled_default.py:20-27 and fixtures/custom_field.json: assistant enabled by default for every System User.

Confidence

Confirmed (production FAC Tool Configuration: run_python_code enabled, Allow All, 552 calls); sandbox bypass Likely

Excerpt from frappe_assistant_core/frappe_assistant_core/plugins/data_science/tools/run_python_code.py, line 49

        self.requires_permission = None  # Available to all users

Excerpt from frappe_assistant_core/frappe_assistant_core/utils/code_execution_subprocess.py, lines 297-303

    env.update(
        {
            "frappe": frappe,
            "get_doc": frappe.get_doc,
            "get_list": frappe.get_list,
            "get_all": frappe.get_all,
            "get_single": frappe.get_single,

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Needs confirmation in production (see the data request list). Compared with the Distribution audit: New. The Distribution audit only asked for "assistant tools enabled". Review-pass sources: G-01

SY-03Security

Anyone can disable a supplier or replace product photos by uploading a file

Severity CriticalConfidence ConfirmedRisk 15 · ExtremeLikelihood LikelyPhase 1 · Effort SQuick win

Issue

An unauthenticated POST to /api/method/upload_file with doctype=Supplier&docname=<supplier id> and any small PDF disables that supplier and sends it back to Draft. Supplier ids are easy to obtain: the guest SRN and IMR endpoints accept and confirm them (G-10). The same request with doctype=Item replaces the product image on all colour variants of an article. That image is then pushed to Olabi on the next sync as sku_image (sportsyard_integration/api_requests/item.py:59, 104-106).

Why it matters

Unauthenticated denial of service on procurement and AP: disabled suppliers block PO, PI and payments. A script could disable all 133. Product-image defacement propagates to the POS and e-commerce systems. Every authenticated user can trigger the same effect too, even without Supplier write permission, because attaching only checks write on the target.

Evidence and code

Observed

erp_sportsyard/erp_sportsyard/customizations/file/file.py:5-19: any File attached to a Supplier sets Supplier.disabled = 1 and workflow_state = "Draft" through frappe.db.set_value. This bypasses permissions and Version. file.py:21-57: any File attached to an Item sets image on every Item whose name matches prefix+colour%, then copies the File with ignore_permissions and commits at :57. frappe/handler.py:177-191: a Guest gets ignore_permissions=True when allow_guests_to_upload_files is on. doctype, docname and is_private come from the caller (:197-199, :252-262). File.validate_attachment_references (frappe/core/doctype/file/file.py:169-178) does not check that the target document exists or that the user may write to it.

Confidence

Confirmed (code + production: guest upload on, allowed_doctypes_for_guest_uploads empty, 53 Guest-owned files)

Excerpt from erp_sportsyard/erp_sportsyard/customizations/file/file.py, lines 4-19

def update_supplier(doc, method=None):
	if doc.attached_to_doctype == "Supplier":
		frappe.db.set_value(
			"Supplier",
			doc.attached_to_name,
			"disabled",
			1,
			update_modified=False,
		)
		frappe.db.set_value(
			"Supplier",
			doc.attached_to_name,
			"workflow_state",
			"Draft",
			update_modified=False,
		)

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Needs confirmation in production (see the data request list). Compared with the Distribution audit: The Distribution lead "file-attach resets Supplier to Draft and disabled" is Confirmed and Changed. In SportsYard the same hook is reachable without authentication, which raises it from integrity to Critical security. Review-pass sources: G-02, A-18, D-10

SY-14Security

Any user who can read a PO can send an approved PO back to draft

Severity HighConfidence ConfirmedRisk 8 · MediumLikelihood PossiblePhase 1 · Effort SQuick win

Issue

A submitted, approved PO with no PR or PI goes back to docstatus 0 without cancel(). That means: no reversal of Payment Request or advance links, budget updates or Olabi state; no Version entry (db_set skips it); no role check.

Why it matters

Approved commitments can be silently altered. The PO approval control and segregation of duties are weakened, and the audit trail is lost.

Evidence and code

Observed

erp_sportsyard/erp_sportsyard/customizations/purchase_order/purchase_order.py:151-170: db_set("workflow_state","Draft"), db_set("status","Draft"), db_set("docstatus",0). The only guard is are_invoices_linked. frappe/handler.py:338-348: run_doc_method requires only read.

Confidence

Confirmed

Excerpt from erp_sportsyard/erp_sportsyard/customizations/purchase_order/purchase_order.py, lines 151-164

	@frappe.whitelist()
	def redraft(self):
		if self.docstatus == 2:
			frappe.msgprint(
				_("Cancelled Purchase Order cannot be redrafted"),
				indicator="red",
				title=_("Error"),
				alert=True,
			)
			return
		are_invoices_linked(self)
		self.db_set("workflow_state", "Draft")
		self.db_set("status", "Draft")
		self.db_set("docstatus", 0)

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Review-pass sources: G-04, A-22, D-13

SY-15Security

PO item exports are written as public files without a permission check

Severity HighConfidence ConfirmedRisk 12 · HighLikelihood LikelyPhase 1 · Effort SQuick win

Issue

Any logged-in user, including the website user, can export full PO line pricing and taxes for any PO. The bulk export's file name is only a timestamp at one-second resolution. An unauthenticated attacker can brute-force a day of exports with 86,400 GETs. The files bypass the File DocType, so they are never cleaned up and are invisible to admins.

Why it matters

Supplier pricing, MRP and tax data leak.

Evidence and code

Observed

…/customizations/purchase_order/purchase_order.py:313-315: frappe.get_doc("Purchase Order", po_name) with no read check. :410-415: file written to public/files/PO_Items_{po}_{YYYYmmddHHMMSS}.xlsx with no File record. :419-423 and :581-592: PO_Items_{YYYYmmddHHMMSS}.xlsx, a timestamp-only name. publish_realtime(..., user=user) sends the URL to any caller-named user.

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Production has 0 public files named PO_Items_* (2026-11-12); exposure is code-level until a file name pattern match is confirmed. Review-pass sources: G-05

SY-16Security

A no-login web method can read any uploaded file, including private ones

Severity HighConfidence ConfirmedRisk 8 · MediumLikelihood PossiblePhase 1 · Effort SQuick win

Issue

No permission check is made before file_doc.get_full_path(). A Guest can read the contents of private CSV and XLSX files: COLUMN_MAP-matched columns in full, and the header and first rows of any other workbook through the error text. [PROD] 8,231 private files, including Bank Account (131), Supplier (553) and Supplier Onboarding Request (56). With allow_error_traceback = 1 [PROD], failures also return full tracebacks to guests. The endpoint also allows CPU and memory exhaustion through crafted ZIPs (zip bomb, XML entity expansion).

Why it matters

Disclosure of private spreadsheets, such as bank statements, price lists and payroll exports, plus denial of service.

Evidence and code

Observed

erp_sportsyard/erp_sportsyard/doctype/item_master_request/item_master_request.py:2025-2031: _get_file looks up any File by file_url. :2560-2588: CSV is opened and returned for mapped columns. :2601-2614: for an unrecognised XLSX, the error message echoes up to 24 cell values from the first 5 rows. The XLSX repair path parses guest-supplied XML with xml.etree (:2069-2105) and holds the whole ZIP in memory.

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: G-06

SY-17Security

A no-login web method can overwrite the rows of any Item Master Request

Severity HighConfidence ConfirmedRisk 8 · MediumLikelihood PossiblePhase 1 · Effort M

Issue

A Guest can: replace the line items (article codes, names, HSN, selling_rate, quantity, images) of any draft or in-workflow IMR, including ones already sent for approval, so approvers then approve attacker data that becomes Items and Material Requests; create unlimited IMRs for any supplier and set status freely.

Why it matters

Item master pollution (73,619 items), with wrong HSN codes and prices flowing into GST and POS. It also allows spam and DoS.

Evidence and code

Observed

item_master_request.py:2652-2677: with no docname, it inserts a new IMR (ignore_permissions). With a caller docname it clears item_master_request_item, appends rows from the file, sets flags.ignore_links, and saves with ignore_permissions=True. :149-158: the workflow states "Send for Article Approval" and "Approve for Material Request Creation" trigger Item and Material Request creation. IMR naming is IMR-.YYYY.- (sequential). create_item_master_form_link_token (:1987-2001) issues a supplier token, but neither the web form insert nor this endpoint checks it. Web form item_master_form.json: login_required 0. Fields supplier, brand, status and the child table are all guest-writable.

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: G-07

SY-18Security

Any logged-in user can run a data-correction script on all past transactions

Severity HighConfidence ConfirmedRisk 4 · LowLikelihood UnlikelyPhase 1 · Effort SQuick win

Issue

Any authenticated user, including the website user, can stamp the first Store Location onto all past transactions, including submitted ones. The GL Entries keep no dimension, so documents and the ledger diverge. There is no Version entry. Running row by row over about 35k invoices and more than 100k child rows in one web request would also hold locks and time out.

Why it matters

Dimension reporting is corrupted and the request is a DoS vector.

Evidence and code

Observed

erp_sportsyard/patches/update_accounting_dimentions.py:66-89: @frappe.whitelist(), then frappe.get_all and frappe.db.set_value(..., store_location, update_modified=False) for every PO, PR, PI, PE, JE, SO, DN and SI and their child and tax tables where store_location is empty. Commits at :89. Also listed in patches.txt:6.

Confidence

Confirmed

Excerpt from erp_sportsyard/patches/update_accounting_dimentions.py, lines 66-72

@frappe.whitelist()
def execute():
    # Fetch one Store Location
    store_location = frappe.db.get_value(
        "Store Location",
        {},
        "name"

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Review-pass sources: G-08, A-14

SY-33Security

Integration Request Log: Olabi bearer token is sent to a per-record URL, `callback_function` is resolved with `get_attr`, and resend methods have no permission check

Severity MediumConfidence ConfirmedRisk 3 · LowLikelihood UnlikelyPhase 1 · Effort SQuick win

Issue

Anyone who can write an IRL (System Manager per the JSON; check Custom DocPerm in production) can point url at an external host to steal the token, or set callback_function to any dotted path, which is a code-execution primitive. bulk_sync and generate_token let any logged-in user re-fire outbound calls or rotate the token. Credentials are stored in plaintext and show in the desk form, exports and backups. [PROD] encrypt_backup = 0.

Why it matters

Evidence and code

Observed

sportsyard_integration/doctype/integration_request_log/integration_request_log.py:21-49: requests.<verb>(self.url, …). :52-57 adds Authorization: Bearer <Olabi auth_token> whatever the URL is. :99-108: frappe.get_attr(self.callback_function)(request=…, response=…). :113-121: bulk_sync has no permission check. olabi_integration.py:137-162: generate_token, no permission check. Olabi Integration fields auth_token, auth_username and auth_password are Data fields (olabi_integration.json). Header values in Key Value Pair value are also Data.

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Compared with the Distribution audit: The Distribution lead "secrets in Data fields" is Confirmed for SportsYard (Olabi). Review-pass sources: G-09, J-07

SY-34Security

Guest SRN helper endpoints leak PO line pricing to anyone who knows the PO number and supplier id

Severity MediumConfidence ConfirmedRisk 6 · MediumLikelihood PossiblePhase 1 · Effort M

Issue

The only "secret" is the supplier id, which is the supplier name or code and is not secret. PO names follow a series. A Guest can enumerate PO pricing. Without po, fetch_items lists every service Item.

Why it matters

Evidence and code

Observed

(…/doctype/service_receipt_note/service_receipt_note.py): :137-147: check_if_po_required, a supplier oracle. :150-159: check_po_date, a PO existence and date oracle. :162-190: fetch_items returns item, qty, rate, base_amount and PO item name when po and supplier match. :193-210: fetch_company_address. :293-307: fetch_po_details.

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: G-10

SY-35Security

Guest web forms (SRN, Supplier Onboarding, Item Master) accept unauthenticated submissions that drive internal workflows and outbound email

Severity MediumConfidence ConfirmedRisk 9 · MediumLikelihood LikelyPhase 1 · Effort M

Issue

Why it matters

Fake SRNs (service invoices) for real suppliers rely on approvers to catch them, so they are a fraud and queue-pollution vector. Outbound email can be abused, and so can storage (10 MB per attachment).

Evidence and code

Observed

erp_sportsyard/erp_sportsyard/web_form/*/*.json: all three have login_required: 0, published: 1, allow_edit: 0. frappe/website/doctype/web_form/web_form.py:639-670: the guest insert uses ignore_permissions. The SRN child table items (rate, amount) and the Data field supplier are guest-set. service_receipt_note.py:20-24 derives base_total from guest amounts. :26-76: on submit by the approver, it creates two Address records from guest text, then a Purchase Receipt, and commits. supplier_onboarding_request.py:13-14, 99-110 emails the guest-supplied email_id with guest-supplied supplier_name, which makes it a spam and phishing relay from the company domain. ServiceReceiptNote.add_workflow_comment (:117-134) needs only read access and emails the supplier any "reject" text. The Web Form class override (customizations/web_form/web_form.py:6-89) only changes translations, so it is not a security concern. Attachments default to private (FileUploader make_attachments_public), but the guest can flip is_private (G-02 path).

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Production web forms item-master-form, service-receipt-note and supplier-onboarding are published with login_required = 0. Compared with the Distribution audit: The Distribution lead "Onboarding creates the Address without a GSTIN" belongs to the Phase E/GST auditor and is not re-checked here. Review-pass sources: G-11

SY-36Security

E-mail workflow actions: `confirm_action` signs the user but has no expiry and no state binding, logs the approver in without authentication, and the confirmation templates are missing

Severity MediumConfidence LikelyRisk 3 · LowLikelihood UnlikelyPhase 2 · Effort SQuick win

Issue

The signature is sound against tampering. Duplicate query keys resolve to the first value (werkzeug MultiDict, tested). Only action_reason is unsigned, which is by design. However, a confirm URL is a bearer credential that never expires and is not tied to a document version. Anyone who obtains it (a forwarded email, Email Queue rows, proxy logs, browser history) can apply the action as the approver without logging in, at any later time when the document is again in a state that allows that action, for example after redraft (G-04). Today the confirmation page template is missing. apply_action therefore probably fails to render (expect "Page not found" or an error), so confirm links are likely never issued and the email Approve and Reject buttons are probably broken.

Why it matters

Evidence and code

Observed

(erp_sportsyard/utils/workflow_action.py): :485-537: signed parameters. user is inside the signature for all four links. The apply and ask links also sign current_state and last_modified. The confirm links sign only action, doctype, docname and user (:517-522, :530-535). :632-656: verify_request is an HMAC-SHA512 over the raw query string with the site secret (frappe/utils/verified_command.py:54-55), GET only. It removes everything after &action_reason= before verifying (:642). :140-142 and :163-165: frappe.set_user(user) when the caller is Guest. :149 and :172: explicit commit on GET. Standard Frappe confirm_action is not allow_guest and does not switch user (frappe/workflow/doctype/workflow_action/workflow_action.py:157-165). The templates custom_confirm_workflow_action and custom_confirm_query (:218, :239) do not exist in any app on the bench.

Confidence

Likely

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Compared with the Distribution audit: Not in the leads table. It relates to the SA-SY-01 area. Review-pass sources: G-12

SY-37Security

Anyone can register a new application against the AI assistant

Severity MediumConfidence ConfirmedRisk 6 · MediumLikelihood PossiblePhase 1 · Effort SQuick win

Issue

An unauthenticated party can register a client named, for example, "SportsYard ERP Assistant" with its own redirect URI, then send an /api/method/frappe.integrations.oauth2.authorize?... link to staff. A user who logs in and clicks Allow gives the attacker a Frappe bearer token. That token works for the MCP endpoint (and G-01) and for the whole /api/resource REST surface as that user. Unlimited registrations also bloat the OAuth Client table.

Why it matters

Evidence and code

Observed

frappe_assistant_core/api/oauth_registration.py:70-175: guest, POST, gated only by enable_dynamic_client_registration [PROD = 1]. utils/oauth_compat.py:216-250 (v15 path) creates an OAuth Client with an attacker-chosen app_name, scopes (default "all") and any https redirect_uris (:317-326). It inserts with ignore_permissions and returns client_secret. skip_authorization = False, so user consent is still required. There is no rate limit and no cap on the number of clients. api/oauth_token.py:37 is the guest token endpoint (standard flow). api/fac_endpoint.py:100-138: MCP accepts any active bearer token, whatever client or scope. :170-190: the API secret is compared with == (not constant time). This is minor.

Confidence

Confirmed (production enable_dynamic_client_registration = 1)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: G-13

SY-38Security

`override_whitelisted_methods`: permission parity

Severity MediumConfidence ConfirmedRisk 6 · MediumLikelihood PossiblePhase 2 · Effort SQuick win

Issue

Why it matters

Evidence and code

Observed

(hooks.py:562-571): gst_hsn_code: the override at customizations/gst_hsn_code/gst_hsn_code.py:4-28 drops frappe.has_permission("Item","write", throw=True) (india_compliance gst_hsn_code.py:22). Any logged-in user can enqueue long-queue jobs, one per 250 items with a 3,600 s timeout. The per-Item save() (:53) still enforces write permission, so the effect is queue flooding rather than tax tampering. It also differs functionally: it saves each item (Version and hooks) instead of the standard bulk replace. update_child_qty_rate: stricter (System Manager only, accounts_controller.py:154-158), then calls the original, so all checks are kept. close_or_unclose_sales_orders: same check as standard (sales_order.py:151 vs erpnext sales_order.py:821). It replaces update_blanket_order with update_sales_pre_order. make_payment_request: delegates to the standard function, which keeps its checks (G-14 covers db_set). make_payment_entry: see G-14. apply_pricing_rule, get_item_details, apply_price_list: full forks; standard has no explicit permission checks either. The risk is drift and upgrade debt, not security. override_whitelisted_methods only redirects HTTP calls. Python callers still reach the originals (rule 3.3).

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Compared with the Distribution audit: n/a Review-pass sources: G-15

SY-39Security

Credentials and personal data at rest and in logs

Severity MediumConfidence ConfirmedRisk 9 · MediumLikelihood LikelyPhase 1 · Effort SQuick win

Issue

Why it matters

Evidence and code

Observed

Olabi auth_token, auth_username and auth_password are Data fields (sportsyard_integration/doctype/olabi_integration/olabi_integration.json). Key Value Pair value is Data and is used for HTTP headers in Olabi and ADP. No hard-coded tokens or URLs were found in erp_sportsyard Python or JS. The search covered http(s) literals and token/secret/password assignments. integration_request_log.py:63-70 writes the full response headers and body into Integration Response Log. bulk_sync errors log the full traceback (:122-127). Supplier Onboarding Request stores pan and gstin as Data, plus PAN card and cancelled-cheque attachments (private by default), with track_changes = 0. [PROD] Error Log tracebacks contain full document JSON with owner emails. That is standard Frappe log_error behaviour (traceback with context), triggered by custom code that raises inside hooks. Assistant Audit Log stores tool inputs and outputs (G-13).

Confidence

Confirmed for code; production evidence for the logs

No code snippet available in the supplied material.

Status or dependency

Compared with the Distribution audit: The "secrets in Data fields" lead is Confirmed. Review-pass sources: G-16, J-12

SY-40Security

Audit trail gaps (compliance)

Severity MediumConfidence ConfirmedRisk 12 · HighLikelihood Almost certainPhase 2 · Effort M

Issue

Why it matters

Evidence and code

Observed

PO redraft docstatus and workflow (G-04); Supplier disabled and workflow_state (file.py:6-19); Item image (file.py:38); the store_location mass update (G-08); Payment Request custom amounts (payment_request.py:198-201); Olabi token (olabi_integration.py:155-161). Looks up Document Audit Trail by linked_name only, not doctype (:28-31, :42-45), so documents of different doctypes with the same name share a trail. Uses insert() and save() without ignore_permissions (:40, :86) as the editing user. The DocType JSON grants only System Manager, so either production has Custom DocPerms for every PO, PI, PR, JE, PE, Item and Supplier editor, or non-SM saves fail. Verify the Custom DocPerm on Document Audit Trail. Re-saves the whole growing log table on every Version, which is O(n) per save. The trail is editable by anyone with write access, so it is not tamper-evident. It is redundant with Version.

Confidence

Confirmed for code; Potential for runtime behaviour

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: G-19

SY-49Security

Error messages show technical details to users

Severity MediumConfidence ConfirmedRisk 9 · MediumLikelihood LikelyPhase 1 · Effort SQuick win

Issue

Error responses include stack traces with file paths, SQL and document payloads; Error Log tracebacks in production already contain full PO JSON with user e-mails.

Why it matters

Helps attackers map the code (incl. guest endpoints) and leaks business data in error dialogs.

Evidence and code

Observed

Production System Settings.allow_error_traceback = 1 (read 2026-11-12)

Confidence

Confirmed (production System Settings)

No code snippet available in the supplied material.

Status or dependency

Review-pass sources:

SY-50Security

API keys are held by vendors and dormant accounts

Severity MediumConfidence ConfirmedRisk 6 · MediumLikelihood PossiblePhase 1 · Effort SQuick win

Issue

Long-lived API keys exist on personal and vendor accounts and a dormant service account; external parties hold desk-level System User access.

Why it matters

Leaked keys give full API access with that user's roles; no evidence of rotation.

Evidence and code

Observed

Production: 10 users with api_key; external vendor account last active 2026-07-15; integration account sportyard@ last active 2025-12-13; ZeroGrunt and consultant accounts are System Users

Confidence

Confirmed (production User list, aggregates)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources:

SY-60Security

Integration whitelisted methods without permission checks

Severity LowConfidence ConfirmedRisk 4 · LowLikelihood PossiblePhase 2 · Effort SQuick win

Issue

Any logged-in user can trigger token refresh, scheduler run, bulk re-send, or probe IRL existence.

Why it matters

Minor abuse or noise

Evidence and code

Observed

OLABI:137,169; IRL:113; OSYNC:4

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: J-14, G-17

SY-66Security

SQL injection review: none exploitable

Severity InfoConfidence ConfirmedRisk 1 · LowLikelihood UnlikelyPhase 3 · Effort S

Issue

Why it matters

Evidence and code

Observed

All f-string and % SQL in these reports was reviewed: workflow_tracking, cash_discount_management_system, cash_discount_enhancement, p2p_report, general_ledger_agl, inward_register, outward_register, rcm_discharged, plus customizations/purchase_order/purchase_order.py:200-215. Interpolated pieces are constants, column names selected by has_column (cash_discount_management_system.py:202-210), %s placeholder lists, or doctype names validated against tabDocType (workflow_tracking.py:146-151). User filters are bound parameters (for example general_ledger_agl.py:210-280, p2p_report.py conditions). The only unsafe pattern, repr(role) and an unescaped PO-name tuple, is in the unwired get_permission_query_conditions (purchase_order.py:200-215). It is dead code; remove it.

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Compared with the Distribution audit: The Distribution SQLi leads (dealer_portal, the budget report) do not apply; there is no equivalent code in erp_sportsyard. Review-pass sources: G-18

Stock, accounting and data

Findings that can make stock values, accounting entries or master data wrong, or that weaken accounting controls.

SY-06Stock, accounting and data

A customisation lets stock revaluation change values in closed periods

Severity HighConfidence ConfirmedRisk 8 · MediumLikelihood PossiblePhase 1 · Effort SQuick win

Issue

Standard ERPNext rejects RIVs on or before the freeze date (2026-02-28) or the last PCV. The override accepts them. The SLE phase then rewrites and commits valuations in the closed period, and the GL phase throws on check_freezing_date (even for Administrator). Result: RIV Failed, SLE ≠ GL for closed periods.

Why it matters

Closed-period stock values change without matching GL. Audit trail of closed books broken. Feeds the Failed RIV count.

Evidence and code

Observed

customizations/repost_item_valuation/repost_item_valuation.py:4-9; hooks.py:468; standard repost_item_valuation.py:77-86,124-130,184-196, stock_ledger.py:299,750, general_ledger.py:391-402,783-804

Confidence

Confirmed (code); share of Failed RIVs Likely

Excerpt from erp_sportsyard/erp_sportsyard/customizations/repost_item_valuation/repost_item_valuation.py, lines 4-9

class OverrideRepostItemValuation(RepostItemValuation):
	def validate_accounts_freeze(self):
		return

	def validate_period_closing_voucher(self):
		return

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: D-03, A-04

SY-10Stock, accounting and data

Submitting a Service Receipt Note saves the goods receipt before the note is finished

Severity HighConfidence ConfirmedRisk 8 · MediumLikelihood PossiblePhase 1 · Effort SQuick win

Issue

Inserts 2 Addresses, inserts and submits a PR, attaches files, then frappe.db.commit(), all before the SRN's docstatus=1 is written. A later failure leaves the PR committed and the SRN unsubmitted. A retry duplicates the PR and Addresses. The mapper sets stock_qty=qty and ignores UOM conversion.

Why it matters

Duplicate service receipts and liabilities ("To Bill"), duplicate supplier addresses

Evidence and code

Observed

erp_sportsyard/erp_sportsyard/doctype/service_receipt_note/service_receipt_note.py:26-77 (commit :76); mapper :208-262

Confidence

Confirmed

Excerpt from erp_sportsyard/erp_sportsyard/doctype/service_receipt_note/service_receipt_note.py, lines 66-76

		purchase_receipt = make_purchase_receipt(self.name)
		purchase_receipt.insert()
		taxes = get_taxes_and_charges(
			"Purchase Taxes and Charges Template", purchase_receipt.get("taxes_and_charges")
		)
		for tax in taxes:
			purchase_receipt.append("taxes", tax)
		purchase_receipt.save()
		purchase_receipt.submit()
		self.attach_documents(purchase_receipt.name)
		frappe.db.commit()

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: D-01

SY-11Stock, accounting and data

The cash discount tool applies the full discount to every linked receipt

Severity HighConfidence ConfirmedRisk 8 · MediumLikelihood PossiblePhase 1 · Effort SQuick win

Issue

A PI linked to k PRs reduces stock value by k × CD, while the JE credits the CDMS account once. The CD is also spread over PR items the PI did not bill. The LCV re-values from the PR date, which triggers backdated reposts.

Why it matters

Under-valued inventory and COGS, residual on the CDMS account, extra RIVs

Evidence and code

Observed

report/cash_discount_management_system/cash_discount_management_system.py:617-675 vs JE :552-613

Confidence

Confirmed

Excerpt from erp_sportsyard/erp_sportsyard/report/cash_discount_management_system/cash_discount_management_system.py, lines 634-661

			for pr_name in linked_prs:
				if not pr_name:
					continue
				pr = frappe.get_doc("Purchase Receipt", pr_name)
				lcv = frappe.new_doc("Landed Cost Voucher")
				lcv.company = pi.company
				lcv.posting_date = today()
				lcv.distribute_charges_based_on = "Amount"

				lcv.append(
					"purchase_receipts",
					{
						"receipt_document_type": "Purchase Receipt",
						"receipt_document": pr.name,
						"supplier": pi.supplier,
						"posting_date": pr.posting_date,
						"grand_total": pr.grand_total,
					},
				)

				lcv.append(
					"taxes",
					{
						"expense_account": cdms_account,
						"amount": -abs(flt(cd_val)),
						"description": _("Cash Discount for Purchase Invoice {0}").format(pi.name),
					},
				)

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: D-06

SY-12Stock, accounting and data

Purchase Order grand total is replaced by the cash-discount amount

Severity HighConfidence LikelyRisk 12 · HighLikelihood LikelyPhase 1 · Effort SQuick win

Issue

after core totals are computed, grand_total = total × pct/100 (for example 2 % of total), ignoring taxes. rounded_total and in_words are not recomputed. Payment Request's custom_paid_amount = grand_total - advance_paid (payment_request.py:136-137) then uses the wrong base, and PE outstanding against the PO is distorted.

Why it matters

wrong PO totals in approvals, budgets, reports and advance payments.

Evidence and code

Observed

customizations/purchase_order/purchase_order.py:42,56-66; percent field labelled "% of Discount" (doctype/cash_discount/cash_discount.json); the same formula is used as the discount amount in payment_request.py:139-142,288

Confidence

Likely

Excerpt from erp_sportsyard/erp_sportsyard/customizations/purchase_order/purchase_order.py, lines 56-66

	def _apply_supplier_cash_discount_grand_total(self):
		if not self.supplier or not self.total:
			return

		pct = get_supplier_cash_discount_percentage(self.supplier)
		if pct <= 0:
			return

		self.grand_total = flt(self.total * pct / 100.0)
		if hasattr(self, "base_total") and self.base_total is not None:
			self.base_grand_total = flt(self.base_total * pct / 100.0)

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: A-05, D-14

SY-21Stock, accounting and data

GST helper overwrites line UOM, description and HSN, persists a non-standard `item_tax_rate`, and leaves stale CGST/SGST on inter-state lines

Severity MediumConfidence ConfirmedRisk 9 · MediumLikelihood LikelyPhase 2 · Effort S–M

Issue

the rows that are saved carry a UOM that may not match the conversion factor, and an item_tax_rate map that standard code (returns, Repost Accounting Ledger, reports reading item_tax_rate) cannot interpret. _calc also runs for returns, unlike the explicit hooks.

Why it matters

GST and UOM inconsistencies on documents that use a non-stock UOM; reporting mismatches.

Evidence and code

Observed

utils/gst_update.py:28-32 (sets uom from stock_uom without changing conversion_factor), :188-193 (on the inter-state branch, cgst_rate/sgst_rate are not reset), :207-216 (item_tax_rate = {"CGST":..} instead of account-head keys); core update_item_tax_map (taxes_and_totals.py:159-165) resets it on the next pass, but the saved value is the custom one

Confidence

Confirmed (code)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Compared with the Distribution audit: "item_tax_rate keyed CGST/SGST": Confirmed (Changed: overwritten after each calculation, persisted on save). "GST helper exits early on inclusive tax": Confirmed (gst_update.py:16). Review-pass sources: A-07

SY-22Stock, accounting and data

Pricing differs between desk (whitelisted overrides) and server/API (core); copied `get_item_details` has drifted

Severity MediumConfidence ConfirmedRisk 9 · MediumLikelihood LikelyPhase 2 · Effort M

Issue

override_whitelisted_methods affects HTTP only. Server-side saves (including POS API) use core get_item_details. Net-margin discounts shown in the form are reset on save, and the API path never applies them. CustomAccountsController (which would have unified this) is not wired.

Why it matters

Evidence and code

Observed

hooks.py:565-567; pricing_rule.py:143-168 (not-discount and net-margin, client path only); server path taxes_and_totals.py:10-86 handles only custom_apply_not_discount; core accounts_controller.py:1081,1167-1189 re-applies core pricing on validate; get_item_details.py drift (see §6.2, including the missing item.check_permission())

Confidence

Confirmed (code)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: A-09

SY-23Stock, accounting and data

Custom GL remarks are written with per-row UPDATEs after submit and lost on every GL repost

Severity MediumConfidence ConfirmedRisk 9 · MediumLikelihood LikelyPhase 3 · Effort S–M

Issue

custom_remarks is set outside get_gl_dict. RIV / Repost Accounting Ledger regenerate the GL without running on_submit, so the remarks disappear. The JE matching is O(rows × GL).

Why it matters

Evidence and code

Observed

purchase_invoice.py:35-54; journal_entry.py:45-79

Confidence

Confirmed (code)

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: A-10, D-19

SY-28Stock, accounting and data

Payment Entry override inserts with `ignore_permissions` and `flags.ignore_validate`

Severity MediumConfidence ConfirmedRisk 6 · MediumLikelihood PossiblePhase 2 · Effort SQuick win

Issue

Draft Payment Entries are persisted without validation and without document-level permission checks, such as user permissions on company or bank account. The custom_paid_amount and custom_cash_discount values come from the client (:195-201, db_set). Validation runs again at submit, which limits the damage.

Why it matters

Evidence and code

Observed

…/customizations/payment_request/payment_request.py:154-177: checks PR read and generic PE create. Then pe.flags.ignore_validate = True (skips the PE controller validate and every doc_event validate, including india_banking), ignore_links, insert(ignore_permissions=True). Standard make_payment_entry returns an unsaved doc (erpnext/accounts/doctype/payment_request/payment_request.py:853-856). :145-150 (create_payment_entry(submit=True)) matches standard ignore_permissions but adds ignore_payment_request_validation.

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: G-14, A-21

SY-29Stock, accounting and data

CDMS job is not idempotent; "JE & LCV created" detection is imprecise

Severity MediumConfidence ConfirmedRisk 6 · MediumLikelihood PossiblePhase 2 · Effort SQuick win

Issue

No existing-JE/LCV check, no job_id, no unique key. Any JE that references the PI, or any LCV on the PR, marks the row "completed" (false positives), while CD rows are still re-selectable (false negatives → duplicates). The S-4 failure committed nothing; the job is atomic.

Why it matters

Duplicate discounts posted

Evidence and code

Observed

cash_discount_management_system.py:487-506, 509-613; detection :297-330,446

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: D-07

SY-32Stock, accounting and data

Whitelisted dead endpoint cancels and rebuilds every PCV; recreated PCVs get `posting_date=None`

Severity MediumConfidence ConfirmedRisk 3 · LowLikelihood UnlikelyPhase 1 · Effort SQuick win

Issue

Not wired to GL posting, but callable at /api/method/.... It cancels every PCV from a fiscal year onwards in one request, then rebuilds them without a posting_date.

Why it matters

Closed books reopened or corrupted by a single call

Evidence and code

Observed

overrides/general_ledger_gl.py:212-261 (fields :219-229, posting_date :259)

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Compared with the Distribution audit: Distribution PCV lead: Changed (present, not wired, still reachable) Review-pass sources: D-15, A-16

SY-51Stock, accounting and data

Negative stock is allowed and the immutable ledger is off

Severity MediumConfidence ConfirmedRisk 9 · MediumLikelihood LikelyPhase 2 · Effort M

Issue

With late ADP postings, negative stock lets sales post before receipts; valuation is then corrected only by reposting. Immutable ledger off allows cancel/amend rewriting of past GL.

Why it matters

Valuation swings and repost load; weaker audit trail for financial postings.

Evidence and code

Observed

Production: Stock Settings.allow_negative_stock = 1 (Moving Average); Accounts Settings.enable_immutable_ledger = 0; acc_frozen_upto 2026-02-28; 4 non-cancelled SLE rows with negative qty_after_transaction; 0 negative Bin rows

Confidence

Confirmed (production Stock and Accounts Settings)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources:

SY-31Stock, accounting and data

Custom depreciation job is never scheduled (name collision with ERPNext job); after_migrate stop targets a non-existent name

Severity LowConfidence ConfirmedRisk 2 · LowLikelihood UnlikelyPhase 3 · Effort SQuick win

Issue

Frappe names Scheduled Job Types from the last two path parts, so erp_sportsyard.erp_sportsyard.depreciation.post_depreciation_entries and ERPNext's job both resolve to 'depreciation.post_depreciation_entries'. Production has only the ERPNext job (Daily Maintenance, running; auto-booking on; 4,166 Assets). migrate.py:11 sets stopped on 'erp_sportsyard.post_depreciation_entries', which does not exist. The custom function (inverted auto-booking check at depreciation.py:18) is dead code. Corrects agent reports that said it always runs / is always stopped.

Why it matters

None today; confusion and risk if someone renames the job.

Evidence and code

Observed

erp_sportsyard/hooks.py:545-547
erp_sportsyard/migrate.py:11
erp_sportsyard/erp_sportsyard/depreciation.py:16-19
frappe/core/doctype/scheduled_job_type/scheduled_job_type.py:52-53
production Scheduled Job Type list

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: D-12

SY-54Stock, accounting and data

Customer on_update tries to disable the customer but the flag is not saved

Severity LowConfidence ConfirmedRisk 6 · MediumLikelihood LikelyPhase 3 · Effort SQuick win

Issue

Why it matters

Evidence and code

Observed

customizations/customer/customer.py:70-78 (self.disabled = 1 after db_update; only workflow_state is written)

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: A-23

SY-55Stock, accounting and data

SLE `before_insert` loads the whole Delivery Note per SLE (lead re-check)

Severity LowConfidence ConfirmedRisk 2 · LowLikelihood UnlikelyPhase 3 · Effort SQuick win

Issue

the per-SLE get_doc("Delivery Note") is still there. warehouse[0] is guarded (:24) and there are no after_commit writes. It has no effect on SI or PR.

Why it matters

Evidence and code

Observed

customizations/stock_ledger_entry/stock_ledger_entry.py:4-25

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Compared with the Distribution audit: Changed (full DN per SLE confirmed; warehouse[0] bug and after_commit writes not present). Review-pass sources: A-24, D-23

Integrations

Data exchanged with ADP, Olabi, the Agilitas India system (SCCT), ZeroGrunt, e-mail and the GST and bank apps. See integration_assessment.md for the 12-point checklist per integration.

SY-04Integrations

The invoice CSV e-mail runs for every store sale and fails almost every time

Severity HighConfidence ConfirmedRisk 16 · ExtremeLikelihood Almost certainPhase 1 · Effort SQuick win

Issue

The job is enqueued for all SIs (34k retail). get_doc("Contact", None) raises DoesNotExistError. The Notification's enabled flag is ignored. Enqueued without after-commit.

Why it matters

Error Log flooded (hides real errors), wasted default-queue capacity, no control over whether B2B customers get their CSV

Evidence and code

Observed

HOOKS:490; SI_C:35-41, 85-94

Confidence

Confirmed (code + [PROD] 1,234 errors / 15 d)

Excerpt from erp_sportsyard/erp_sportsyard/customizations/sales_invoice/sales_invoice.py, lines 35-41

def on_submit(doc, method):
	frappe.enqueue(
		"erp_sportsyard.erp_sportsyard.customizations.sales_invoice.sales_invoice.send_sales_invoice_csv",
		docname=doc.name,
		queue="default",
		timeout=300,
	)

Excerpt from erp_sportsyard/erp_sportsyard/customizations/sales_invoice/sales_invoice.py, lines 89-91

	inv = frappe.get_doc("Sales Invoice", docname)
	# Get recipients from notification
	recipients = [x.email_id for x in frappe.get_doc("Contact", inv.contact_person).email_ids]

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Public-file aspect: production has 0 public files named Sales_Invoice_*.csv (2026-11-12), so the exposure is code-level only; G-03 downgraded from High to part of this item. Review-pass sources: J-01, A-02, D-08, G-03, J-16

SY-08Integrations

Nothing stops the same ADP bill from being posted twice

Severity HighConfidence LikelyRisk 12 · HighLikelihood LikelyPhase 1 · Effort M

Issue

External bill no. custom_invoice_no / custom_invoice_id is not unique and not checked. Server-side naming means a replay after a timeout creates a second submitted SI with stock and GL.

Why it matters

Duplicate revenue, GST liability and stock deduction; manual cleanup

Evidence and code

Observed

CF/sales_invoice.json:4
CF/purchase_receipt.json:4; SI_C:13-22, 44-68 (no dup check); no whitelisted inbound endpoint

Confidence

Likely (code confirmed; duplicates need a [PROD] query)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: J-02

SY-09Integrations

Approving a PO to Agilitas India waits on the other system and saves half-way

Severity HighConfidence ConfirmedRisk 16 · ExtremeLikelihood Almost certainPhase 1 · Effort SQuick win

Issue

HTTP (≤70 s) runs while the PO holds Bin locks from the standard on_submit; finally: frappe.db.commit() commits the PO before later hooks.

Why it matters

Lock waits on Bin for other PR/PO/SI; partially processed submit if a later hook fails; user waits

Evidence and code

Observed

PO_C:610-625; API_PO:123-146 (flags.now :145); IRL:17-19, 50-51

Confidence

Confirmed

Excerpt from erp_sportsyard/sportsyard_integration/api_requests/purchase_order.py, lines 132-147


	request_log = frappe.get_doc(
		{
			"doctype": "Integration Request Log",
			"request_type": "POST",
			"request_status": "Pending",
			"linked_doctype": "Purchase Order",
			"linked_docname": po.name,
			"request_description": "SCCT PO API Request",
			"url": scct_url,
			"request_payload": json.dumps(payload, indent=4, default=str),
		}
	)
	request_log.flags.now = True
	request_log.insert()

Excerpt from erp_sportsyard/sportsyard_integration/doctype/integration_request_log/integration_request_log.py, lines 50-52

		finally:
			frappe.db.commit()
		return self, response

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: J-05, D-02, J-06

SY-30Integrations

ADP sends dates in the wrong format and 158 store sales were rejected

Severity MediumConfidence ConfirmedRisk 9 · MediumLikelihood LikelyPhase 1 · Effort SQuick win

Issue

158 rejected inserts for the 2026-11-01 business date. Before the INSERT, Python parses "01-11-2026" as 11 January. Nothing persisted.

Why it matters

Missing POS invoices for that day unless they were re-sent

Evidence and code

Observed

No custom code path. Standard transaction_base.py:26-34; frappe utils/data.py:84-107; custom sales_invoice.py:19 (FY from misparsed date)

Confidence

Confirmed (production: 158 SQL 1292 errors)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: D-09, J-04

SY-41Integrations

Cancelled PO stays open in Olabi when the cancel happens before the create is sent

Severity MediumConfidence ConfirmedRisk 6 · MediumLikelihood PossiblePhase 2 · Effort SQuick win

Issue

The cancel IRL is created only if custom_is_synced_olabi=1, which is set asynchronously. A Pending create is still sent after cancel.

Why it matters

Stores receive goods against a cancelled PO

Evidence and code

Observed

PO_C:612-614; API_PO:105-114; OLABI:106-121

Confidence

Confirmed (code path)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: J-09

SY-42Integrations

`custom_is_synced_olabi` copied on amend/duplicate, so amended POs never auto-sync

Severity MediumConfidence LikelyRisk 9 · MediumLikelihood LikelyPhase 2 · Effort SQuick win

Issue

The amended PO starts with synced=1, so the hook skips it.

Why it matters

Olabi missing the corrected PO

Evidence and code

Observed

CF/purchase_order.json:64 (no no_copy); PO_C:612

Confidence

Likely

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: J-10

SY-43Integrations

Retry/concurrency weaknesses in IRL processor

Severity MediumConfidence LikelyRisk 6 · MediumLikelihood PossiblePhase 2 · Effort M

Issue

No row lock: scheduler, Send button and bulk_sync can double-send. Business rejections retried with no backoff. Global max_retry. Serial batch on 300 s queue; blank batch_size fetches all. Dedup check uses the wrong job id.

Why it matters

Duplicate POs/articles in Olabi; stuck queues

Evidence and code

Observed

OLABI:77-95, 110-134; IRL:13-15, 21-52, 113-140

Confidence

Likely

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: J-13, A-20

SY-44Integrations

Full PO JSON posted by client for sync/dup-check; truncated body error

Severity MediumConfidence LikelyRisk 6 · MediumLikelihood PossiblePhase 2 · Effort SQuick win

Issue

Large POs (>350 KB JSON) are posted in full; the body arrived truncated. Not a DB column limit.

Why it matters

User cannot sync or act on large POs

Evidence and code

Observed

PO_C.js:14-16, 69-73; OSYNC:4-8
frappe/handler.py:333
frappe/model/workflow.py:101

Confidence

Likely ([PROD] "Unterminated string … char 351034")

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: J-17, D-18

SY-45Integrations

ZeroGrunt reads purchase orders through a full staff account

Severity MediumConfidence PotentialRisk 9 · MediumLikelihood LikelyPhase 1 · Effort SQuick win

Issue

External vendor user has System User access; 13 webhooks undocumented; no code ownership.

Why it matters

Over-broad data access by third party; untracked integration

Evidence and code

Observed

[PROD] Webhook + User records
frappe/integrations/doctype/webhook/webhook.py:158-197

Confidence

Potential

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: J-18

SY-46Integrations

No reconciliation for any integration

Severity MediumConfidence ConfirmedRisk 12 · HighLikelihood Almost certainPhase 2 · Effort M

Issue

Olabi, SCCT, ADP, ZeroGrunt and IC all lack periodic comparison.

Why it matters

Silent divergence (missing or duplicate sales, cancelled POs open)

Evidence and code

Observed

No code found (sections 2-7)

Confidence

Confirmed (absence)

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: J-19

SY-47Integrations

Payment Request override may be shadowed by india_banking; PE draft inserted with ignore_validate

Severity MediumConfidence PotentialRisk 6 · MediumLikelihood PossiblePhase 2 · Effort S

Issue

The last installed app's class override wins. ignore_validate skips all standard PE validation on the draft.

Why it matters

Cash-discount logic may not run; invalid drafts feed payment/H2H steps

Evidence and code

Observed

HOOKS:455,564
india_banking/hooks.py:28
frappe/model/base_document.py:89-91; PRQ_C:166-172, 203-213

Confidence

Potential (override order) / Confirmed (ignore_validate)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: J-20

SY-48Integrations

India Compliance API failures (1,562) not from custom code; scheduler stopped

Severity MediumConfidence PotentialRisk 9 · MediumLikelihood LikelyPhase 3 · Effort S

Issue

Standard IC calls failing until 2026-09-22; download_queued_request stopped.

Why it matters

Possible missing GSTIN validation or e-docs; returns download gaps

Evidence and code

Observed

[PROD] Integration Request; HOOKS:570; HSN_C

Confidence

Potential

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: J-25

SY-58Integrations

Integration callback robustness: None callback; PR `mark_as_synced` can never succeed

Severity LowConfidence ConfirmedRisk 8 · MediumLikelihood Almost certainPhase 2 · Effort SQuick win

Issue

S-5a. PR returns are never flagged synced.

Why it matters

Error noise; retries or manual effort

Evidence and code

Observed

integration_request_log.py:84,101-110; api_requests/purchase_receipt.py:59-69 ("status" == "success")

Confidence

Confirmed (production: 4 'Integration API Callback Error')

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: D-17, J-08, J-11

SY-61Integrations

IRL logs unbounded; response headers stored; no retention

Severity LowConfidence ConfirmedRisk 8 · MediumLikelihood Almost certainPhase 3 · Effort SQuick win

Issue

Every response with headers is stored in Long Text forever.

Why it matters

DB growth; possible leakage of tokens if Olabi echoes them

Evidence and code

Observed

IRL:65-99; HOOKS:635 (commented)

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: J-15

SY-62Integrations

Item → Olabi sync on every variant save; payload crash/“None” strings

Severity LowConfidence ConfirmedRisk 6 · MediumLikelihood LikelyPhase 3 · Effort SQuick win

Issue

HSN bulk updates and template price updates create an IRL per variant. Empty vendor_desc raises TypeError and blocks the item save. Literal "None" values are sent.

Why it matters

Olabi API flood; item saves blocked; bad master data in Olabi

Evidence and code

Observed

ITEM_C:129-139; API_ITEM:38,45-48,66-69,76-78; HSN_C:31-53

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: J-21

SY-63Integrations

Consolidated report window resets every January; unbounded body

Severity LowConfidence ConfirmedRisk 8 · MediumLikelihood Almost certainPhase 3 · Effort SQuick win

Issue

Old un-invoiced GRNs drop off on 1 Jan; HTML can grow very large; no toggle.

Why it matters

Missed accrual follow-up

Evidence and code

Observed

CRE:24-26, 85-113, 153-180

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: J-22

SY-64Integrations

ADP Integration doctype unused; inbound runs on generic REST with no inbound contract

Severity InfoConfidence ConfirmedRisk 2 · LowLikelihood PossiblePhase 3 · Effort SQuick win

Issue

The settings exist but no code uses them. ADP's contract (fields, retries, auth roles) is undocumented in code.

Why it matters

Unclear ownership

Evidence and code

Observed

ADP:5-6
ADP.json; no reader (grep)

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: J-23

SY-65Integrations

SOW integrations Shopify, Increff, Aegis, Databricks, Australia systems, Mochiko not in code

Severity InfoConfidence ConfirmedRisk 2 · LowLikelihood PossiblePhase 3 · Effort SQuick win

Issue

Not found in code; confirm with stakeholders. SCCT and Olabi are present. Other work may exist on unmerged remote branches (e.g. dot_com_integration).

Why it matters

Scope gap

Evidence and code

Observed

grep over apps/erp_sportsyard: 0 hits; branches: only upstream/main fetched

Confidence

Confirmed (absence)

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Review-pass sources: J-24

Performance and reliability

What makes the system slow or busy: stock revaluation, per-line tax logic and background jobs. All query counts are estimates from reading the code, not measurements.

SY-05Performance and reliability

Late store sales from ADP cause constant stock revaluation

Severity HighConfidence ConfirmedRisk 16 · ExtremeLikelihood Almost certainPhase 2 · Effort M

Issue

Each late SI creates one Item-and-Warehouse RIV per item-warehouse when future SLEs exist (4 warehouses → almost always). Moving Average reposts rewrite all later SLE and GL, which leads to 1,500 s timeouts. Not caused by custom code.

Why it matters

28k RIVs, hourly long-queue saturation, valuation and COGS lag, stock/GL drift while RIVs are pending or failed

Evidence and code

Observed

erpnext/controllers/stock_controller.py:1448-1474,1786-1811,1905-1934
production: 34,078 update_stock SIs, avg 1.9-day lag, 7,437 SIs more than 1 day late

Confidence

Confirmed (production: 33,817 of 34,151 SIs by ADP user, 34,085 with set_posting_time, avg 1.9-day lag, 28,382 RIV)

No code snippet available in the supplied material.

Status or dependency

Compared with the Distribution audit: Distribution I-2 analogue: standard behaviour, Confirmed Review-pass sources: D-05, A-03, J-03

SY-07Performance and reliability

A database script runs stock revaluation inside the web server

Severity HighConfidence ConfirmedRisk 12 · HighLikelihood LikelyPhase 1 · Effort SQuick win

Issue

Two processes run repost_entries on the same queue. A request timeout leaves RIVs "In Progress". The commit happens inside the request. It enqueues the non-existent riv_background_worker.

Why it matters

Lock waits and deadlocks with POS posting, duplicated repost work, RIVs stuck, noise

Evidence and code

Observed

brief; standard erpnext/hooks.py:435, repost_item_valuation.py:331-414,521-540

Confidence

Confirmed (production Server Script read 2026-11-12)

Production Server Script "repost item valuation" (API method repost_background_worker), excerpt

job = frappe.get_doc("Scheduled Job Type", sjt_name)
job.execute()          # runs the real, unmodified erpnext repost_entries() ...
frappe.db.commit()
...
    frappe.enqueue(
        function="riv_background_worker",
        queue="long",
        timeout=7200,

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Review-pass sources: D-04

SY-13Performance and reliability

Tax-template logic adds about seven database look-ups per line, several times per save

Severity HighConfidence ConfirmedRisk 12 · HighLikelihood LikelyPhase 2 · Effort M

Issue

every core calculate_taxes_and_totals call is wrapped, so the helper runs after each calculation, again from explicit before_save/before_submit hooks, and once more nested when a template changes. Per pass it costs get_all(Item Tax) + 2 queries per slab row + 2 more per line. For 1,000 lines that is about 14k–28k queries per save (theoretical).

Why it matters

slow saves and submits on large PO/PR/PI, more lock time, timeouts on 800–1,000-line documents.

Evidence and code

Observed

erp_sportsyard/__init__.py:3; overrides/taxes_and_totals.py:7,89-104; utils/gst_update.py:21-224 (uncached get_doc at :60 inside the slab loop and again at :119; get_all at :37; logger at :221); sales_invoice.py:25-32; purchase_invoice.py:9-25; purchase_order.py:124,128

Confidence

Confirmed (code); counts theoretical

No code snippet available in the supplied material.

Status or dependency

Needs confirmation in production (see the data request list). Compared with the Distribution audit: "GST helper ~7 uncached queries per line on save and submit": Confirmed Review-pass sources: A-01

SY-24Performance and reliability

Item save performs full scans (EAN, style code) and a broken sequence generator that loops `exists()`

Severity MediumConfidence ConfirmedRisk 12 · HighLikelihood Almost certainPhase 2 · Effort SQuick win

Issue

Why it matters

Evidence and code

Observed

item.py:51 (ean, unindexed), :601-605 (custom_style_code, unindexed), :192-233 (selects name, reads item_code at :217, so seq_num=1 and then a while exists() loop)

Confidence

Confirmed (code); index absence from JSON (confirm in DB)

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: A-11, D-20

SY-25Performance and reliability

Document Audit Trail hook rewrites the full history on every save, with an unindexed lookup that ignores DocType

Severity MediumConfidence ConfirmedRisk 12 · HighLikelihood Almost certainPhase 2 · Effort SQuick win

Issue

O(history) writes on every save. Two DocTypes with the same docname share one trail.

Why it matters

Evidence and code

Observed

utils/generate_audit_trail.py:28-45 (filter on linked_name only; document_audit_trail.json has no index), :70-86 (shifts the idx of all rows and saves, so every child row is updated)

Confidence

Confirmed (code)

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: A-12, D-22

SY-57Performance and reliability

Synchronous SMTP inside Payment Request `on_update`

Severity LowConfidence ConfirmedRisk 4 · LowLikelihood PossiblePhase 2 · Effort SQuick win

Issue

sendmail(now=True). SMTP latency or failure blocks or fails the approval.

Why it matters

Slow or failed approvals

Evidence and code

Observed

customizations/payment_request/payment_request.py:218-255, 275-277

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: D-16

Code and configuration

Code health, upgrade readiness, deployment and configuration kept outside source control.

SY-19Code and configuration

The replaced tax calculation breaks on a standard ERPNext recalculation path

Severity MediumConfidence ConfirmedRisk 3 · LowLikelihood UnlikelyPhase 2 · Effort SQuick win

Issue

when core sets need_recomputation, it calls the patched method with a keyword argument that the patch does not accept.

Why it matters

an unexpected save failure on discounted documents.

Evidence and code

Observed

erpnext/controllers/taxes_and_totals.py:51,64-65 (self.calculate(ignore_tax_template_validation=True)) against overrides/taxes_and_totals.py:89 (def _calc(self))

Confidence

Confirmed (code)

Excerpt from erp_sportsyard/erp_sportsyard/overrides/taxes_and_totals.py, lines 89-104

def _calc(self):
	items = self.doc.get("items", [])
	not_pcts = [(i, _get_not_discount_pct(i, self.doc)) for i in items]
	for i, pct in not_pcts:
		if pct is not None:
			i.discount_percentage = pct
	_orig(self)
	try:
		from erp_sportsyard.utils.gst_update import set_item_tax_template_based_on_rate

		set_item_tax_template_based_on_rate(self.doc)
	except Exception as e:
		frappe.logger().error(f"Error in set_item_tax_template_based_on_rate override: {e}")


calculate_taxes_and_totals.calculate = _calc

Shown to explain the issue. Quoted unchanged from the audited code or production configuration; not a proposed change.

Status or dependency

Review-pass sources: A-06

SY-20Code and configuration

`calculate_taxes_and_totals.calculate` monkey-patch swallows GST template errors

Severity MediumConfidence ConfirmedRisk 6 · MediumLikelihood PossiblePhase 2 · Effort SQuick win

Issue

Exceptions go only to the file logger. The document posts with whatever tax templates were there before. The patch also overwrites item.uom with stock_uom without changing the conversion factor, and toggles a class attribute at runtime.

Why it matters

Silent GST mis-classification on SI/PI/PR, UOM display inconsistency

Evidence and code

Observed

overrides/taxes_and_totals.py:89-104; utils/gst_update.py:21-31,227-234

Confidence

Confirmed (code)

No code snippet available in the supplied material.

Status or dependency

Compared with the Distribution audit: Changed: the Distribution set_missing_item_details patch is not wired here (customizations/accounts_controller/accounts_controller.py:23, dead). The live core patch is calculate. Review-pass sources: D-11, A-08

SY-26Code and configuration

Deploy pipeline goes to prod on every push to main without tests or lint, and wipes the RQ queue

Severity MediumConfidence ConfirmedRisk 12 · HighLikelihood Almost certainPhase 1 · Effort S–MQuick win

Issue

queued jobs (CSV mails, Olabi triggers, webhook deliveries, enqueued reposts) are deleted on deploy; migrate runs with no gate.

Why it matters

Evidence and code

Observed

.github/workflows/cicd-prod-k8s.yml:3-5,137-151,169-176; tests (§5)

Confidence

Confirmed (code)

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: A-13

SY-27Code and configuration

Most configuration is not in source control; migrate re-applies the repo copy

Severity MediumConfidence ConfirmedRisk 12 · HighLikelihood Almost certainPhase 3 · Effort M

Issue

Why it matters

Evidence and code

Observed

repo 161 CF / 127 PS against prod about 1,000 / 430; migrate.py:8-35; Server Script, Webhooks and Notifications are DB-only

Confidence

Confirmed (repo 161 Custom Fields / 127 Property Setters vs production ~1,000 / ~430)

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: A-19

SY-52Code and configuration

Hooks-imported AR report patch is non-deterministic across workers

Severity LowConfidence LikelyRisk 6 · MediumLikelihood LikelyPhase 3 · Effort SQuick win

Issue

Why it matters

Evidence and code

Observed

hooks.py:573; report/accounts_receivable_patch.py:4-56; frappe/__init__.py:1636-1639 (hooks served from Redis, so hooks.py is not imported in most workers)

Confidence

Likely

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: A-15

SY-53Code and configuration

Redundant monkey-patch of `get_allowed_types_from_settings`

Severity LowConfidence ConfirmedRisk 4 · LowLikelihood PossiblePhase 3 · Effort SQuick win

Issue

Why it matters

Evidence and code

Observed

overrides/__init__.py:1-7; overrides/reporst_accounting_ledger.py:5-19; core already de-duplicates (repost_accounting_ledger.py:444-462)

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: A-17

SY-56Code and configuration

Hard-coded master names

Severity LowConfidence ConfirmedRisk 4 · LowLikelihood PossiblePhase 3 · Effort SQuick win

Issue

Why it matters

Evidence and code

Observed

sales_invoice.py:85, purchase_order.py:133, journal_entry.py:11, item.py:143,182, api_requests/item.py:42

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: A-25

SY-59Code and configuration

DN/PR/SO override `before_insert` without `super()`

Severity LowConfidence ConfirmedRisk 2 · LowLikelihood UnlikelyPhase 3 · Effort SQuick win

Issue

Skips clear_clearance_date_on_amend

Why it matters

Negligible today

Evidence and code

Observed

customizations/delivery_note/delivery_note.py:27-39; customizations/purchase_receipt/purchase_receipt.py:27-39; customizations/sales_order/sales_order.py:59-65; standard accounts_controller.py:149-150

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: D-21

SY-67Code and configuration

GST and e-invoice paths touched by custom code (pointer for the GST auditor)

Severity InfoConfidence ConfirmedRisk 1 · LowLikelihood UnlikelyPhase 3 · Effort S

Issue

Why it matters

Evidence and code

Observed

erp_sportsyard/__init__.py:3 imports overrides/taxes_and_totals.py, which monkey-patches calculate_taxes_and_totals.calculate (:7, :89-104). Every transaction's taxable values therefore come from custom code, and so does the e-invoice and GSTR data that india_compliance derives from them. utils/gst_update.py:15 returns early when the first tax row is included_in_print_rate. The Distribution lead "GST helper exits early on inclusive tax" is Confirmed for SportsYard. This matters because 34k POS invoices may be inclusive. customizations/gst_hsn_code override (G-15). [PROD] India Compliance API: 1,562 failed Integration Requests (last on 2026-09-22). No custom code calls e-invoice or e-waybill generation directly.

Confidence

Confirmed for location

No code snippet available in the supplied material.

Status or dependency

Review-pass sources: G-20

SY-68Code and configuration

Distribution leads not applicable

Severity InfoConfidence ConfirmedRisk 1 · LowLikelihood UnlikelyPhase 3 · Effort S

Issue

Budget read-modify-write: Refuted. GL unique ID MAX(): Refuted. DN for Supplier: N/A. Inbound gate-entry PR/DN: N/A. Commit count 61: Changed (10).

Why it matters

—

Evidence and code

Observed

grep (no budget code, no unique_id_gl, no DN-for-Supplier doctype, no dealer portal, no inbound DN/PR API)

Confidence

Confirmed

No code snippet available in the supplied material.

Status or dependency

Compared with the Distribution audit: as stated Review-pass sources: D-24

Recommendations and next steps

The plan has four phases. Containment steps that limit exposure quickly are listed separately from permanent fixes. Nothing in the plan bypasses standard stock, accounting or permission checks to gain speed. These are recommendations only: no code or configuration was changed during the review.

Source: recommendations_roadmap.md. Effort is indicative developer time, excluding business validation: S up to 2 days, M 3–10, L 10–25, XL more than 25.

Phase 0 · This week: containment through settings no code deployment

#	Action	Findings	Owner
0.1	Block the no-login PDF address at the proxy or firewall	SY-01	Agilitas IT
0.2	Disable or restrict the assistant's code and database-query tools; restrict document submit and fetch	SY-02	Agilitas IT
0.3	Turn off open app registration for the assistant and review the registered apps	SY-37	Agilitas IT
0.4	Limit guest uploads to the onboarding, service receipt and item request forms, or turn them off	SY-03	Agilitas IT + Procurement
0.5	Turn off technical error details for users	SY-49	Agilitas IT
0.6	Disable the database script that runs stock revaluation in the web server	SY-07	Agilitas IT
0.7	Revoke dormant and vendor API keys; review external users' roles	SY-50 SY-45	Agilitas IT + integration owners
0.8	Ask ADP to send ISO dates and to post sales the same day	SY-30 SY-05	Retail ops + ADP

Phase 1 · Next 3–5 weeks: critical risk reduction 27 items · mostly small code fixes

ID	Action area	Severity	Effort	Quick win
SY-01	Anyone can download a PDF of any document without logging in	Critical	S	Yes
SY-02	Every assistant user can run their own Python code on the server	Critical	S	Yes
SY-03	Anyone can disable a supplier or replace product photos by uploading a file	Critical	S	Yes
SY-04	The invoice CSV e-mail runs for every store sale and fails almost every time	High	S	Yes
SY-06	A customisation lets stock revaluation change values in closed periods	High	S	Yes
SY-07	A database script runs stock revaluation inside the web server	High	S	Yes
SY-08	Nothing stops the same ADP bill from being posted twice	High	M	No
SY-09	Approving a PO to Agilitas India waits on the other system and saves half-way	High	S	Yes
SY-10	Submitting a Service Receipt Note saves the goods receipt before the note is finished	High	S	Yes
SY-11	The cash discount tool applies the full discount to every linked receipt	High	S	Yes
SY-12	Purchase Order grand total is replaced by the cash-discount amount	High	S	Yes
SY-14	Any user who can read a PO can send an approved PO back to draft	High	S	Yes
SY-15	PO item exports are written as public files without a permission check	High	S	Yes
SY-16	A no-login web method can read any uploaded file, including private ones	High	S	Yes
SY-17	A no-login web method can overwrite the rows of any Item Master Request	High	M	No
SY-18	Any logged-in user can run a data-correction script on all past transactions	High	S	Yes
SY-26	Deploy pipeline goes to prod on every push to main without tests or lint, and wipes the RQ queue	Medium	S–M	Yes
SY-30	ADP sends dates in the wrong format and 158 store sales were rejected	Medium	S	Yes
SY-32	Whitelisted dead endpoint cancels and rebuilds every PCV; recreated PCVs get `posting_date=None`	Medium	S	Yes
SY-33	Integration Request Log: Olabi bearer token is sent to a per-record URL, `callback_function` is resolved with `get_attr`, and resend methods have no permission check	Medium	S	Yes
SY-34	Guest SRN helper endpoints leak PO line pricing to anyone who knows the PO number and supplier id	Medium	M	No
SY-35	Guest web forms (SRN, Supplier Onboarding, Item Master) accept unauthenticated submissions that drive internal workflows and outbound email	Medium	M	No
SY-37	Anyone can register a new application against the AI assistant	Medium	S	Yes
SY-39	Credentials and personal data at rest and in logs	Medium	S	Yes
SY-45	ZeroGrunt reads purchase orders through a full staff account	Medium	S	Yes
SY-49	Error messages show technical details to users	Medium	S	Yes
SY-50	API keys are held by vendors and dormant accounts	Medium	S	Yes

Phase 2 · Next 1–2 months: performance and reliability 23 items · with ADP and the integration owners

ID	Action area	Severity	Effort	Quick win
SY-05	Late store sales from ADP cause constant stock revaluation	High	M	No
SY-13	Tax-template logic adds about seven database look-ups per line, several times per save	High	M	No
SY-19	The replaced tax calculation breaks on a standard ERPNext recalculation path	Medium	S	Yes
SY-20	`calculate_taxes_and_totals.calculate` monkey-patch swallows GST template errors	Medium	S	Yes
SY-21	GST helper overwrites line UOM, description and HSN, persists a non-standard `item_tax_rate`, and leaves stale CGST/SGST on inter-state lines	Medium	S–M	No
SY-22	Pricing differs between desk (whitelisted overrides) and server/API (core); copied `get_item_details` has drifted	Medium	M	No
SY-24	Item save performs full scans (EAN, style code) and a broken sequence generator that loops `exists()`	Medium	S	Yes
SY-25	Document Audit Trail hook rewrites the full history on every save, with an unindexed lookup that ignores DocType	Medium	S	Yes
SY-28	Payment Entry override inserts with `ignore_permissions` and `flags.ignore_validate`	Medium	S	Yes
SY-29	CDMS job is not idempotent; "JE & LCV created" detection is imprecise	Medium	S	Yes
SY-36	E-mail workflow actions: `confirm_action` signs the user but has no expiry and no state binding, logs the approver in without authentication, and the confirmation templates are missing	Medium	S	Yes
SY-38	`override_whitelisted_methods`: permission parity	Medium	S	Yes
SY-40	Audit trail gaps (compliance)	Medium	M	No
SY-41	Cancelled PO stays open in Olabi when the cancel happens before the create is sent	Medium	S	Yes
SY-42	`custom_is_synced_olabi` copied on amend/duplicate, so amended POs never auto-sync	Medium	S	Yes
SY-43	Retry/concurrency weaknesses in IRL processor	Medium	M	No
SY-44	Full PO JSON posted by client for sync/dup-check; truncated body error	Medium	S	Yes
SY-46	No reconciliation for any integration	Medium	M	No
SY-47	Payment Request override may be shadowed by india_banking; PE draft inserted with ignore_validate	Medium	S	No
SY-51	Negative stock is allowed and the immutable ledger is off	Medium	M	No
SY-57	Synchronous SMTP inside Payment Request `on_update`	Low	S	Yes
SY-58	Integration callback robustness: None callback; PR `mark_as_synced` can never succeed	Low	S	Yes
SY-60	Integration whitelisted methods without permission checks	Low	S	Yes

Phase 3 · Next quarter: maintainability and upgrade readiness 18 items

ID	Action area	Severity	Effort	Quick win
SY-23	Custom GL remarks are written with per-row UPDATEs after submit and lost on every GL repost	Medium	S–M	No
SY-27	Most configuration is not in source control; migrate re-applies the repo copy	Medium	M	No
SY-48	India Compliance API failures (1,562) not from custom code; scheduler stopped	Medium	S	No
SY-31	Custom depreciation job is never scheduled (name collision with ERPNext job); after_migrate stop targets a non-existent name	Low	S	Yes
SY-52	Hooks-imported AR report patch is non-deterministic across workers	Low	S	Yes
SY-53	Redundant monkey-patch of `get_allowed_types_from_settings`	Low	S	Yes
SY-54	Customer on_update tries to disable the customer but the flag is not saved	Low	S	Yes
SY-55	SLE `before_insert` loads the whole Delivery Note per SLE (lead re-check)	Low	S	Yes
SY-56	Hard-coded master names	Low	S	Yes
SY-59	DN/PR/SO override `before_insert` without `super()`	Low	S	Yes
SY-61	IRL logs unbounded; response headers stored; no retention	Low	S	Yes
SY-62	Item → Olabi sync on every variant save; payload crash/“None” strings	Low	S	Yes
SY-63	Consolidated report window resets every January; unbounded body	Low	S	Yes
SY-64	ADP Integration doctype unused; inbound runs on generic REST with no inbound contract	Info	S	Yes
SY-65	SOW integrations Shopify, Increff, Aegis, Databricks, Australia systems, Mochiko not in code	Info	S	Yes
SY-66	SQL injection review: none exploitable	Info	S	No
SY-67	GST and e-invoice paths touched by custom code (pointer for the GST auditor)	Info	S	No
SY-68	Distribution leads not applicable	Info	S	No

Open questions

Code and configuration show what the system does, but not always why or what the business expects. The audit has not guessed these answers, and each answer may change a recommendation.

Questions for the business

Question	Owner	Findings
What should the cash-discount % on a PO mean? Should the grand total really be replaced?	Finance	SY-12
When one purchase invoice covers several receipts, how should the cash discount be split?	Finance	SY-11
Should stock revaluation ever change values in closed or frozen periods?	Finance / Audit	SY-06
Can ADP post sales on the day, in ISO date format? What delay is acceptable?	Retail ops / ADP	SY-05 SY-30
Which ADP field uniquely identifies a bill, and should repeats be rejected?	Retail ops / ADP	SY-08
Who should use the AI assistant, and is running custom code needed?	IT / Leadership	SY-02
Should the onboarding, service-receipt and item-request forms work without login?	Procurement	SY-03 SY-35
Which customers should receive the invoice CSV e-mail?	Sales / Finance	SY-04
What access should ZeroGrunt and other vendors have, and under what agreement?	Procurement / Legal	SY-45 SY-50
Should approvers be able to approve from e-mail without logging in?	Finance	SY-36
Is the 'send approved PO back to draft' button needed, and who may use it?	Procurement	SY-14
Should negative stock remain allowed once ADP posts on time?	Finance / Retail ops	SY-51
Do Shopify, Increff, Aegis, Databricks, the Australia systems or Mochiko exchange data with SportsYard?	IT	SY-65

What is not yet known

Gap	Why it matters	How to close it
Which code version is deployed	Production shows only version 0.0.1	Deployed commit hash from DevOps
Whether the no-login addresses have been used by outsiders	Breach assessment	90 days of web server access logs
Why the 5,150 stock revaluations failed	Separates timeouts from closed-period failures	Grouped error counts
Whether ADP re-sent the 158 rejected bills	Possible missing store sales	ADP's own list
Lock and deadlock database settings	Exact rollback behaviour	DBA values and a one-week deadlock capture
Who uses the AI assistant and for what	Size of the code-execution exposure	Assistant log by user and tool

The full list of 21 evidence requests, with owners, is in data_request_list.md.

All findings

All 68 findings in one list. Type an ID or keyword, or narrow by severity, confidence, area or phase. Select an ID to open its full card.

Showing 68 of 68 findings

ID	Finding	Area	Severity	Confidence	Phase
SY-01	Anyone can download a PDF of any document without logging in	Security	Critical	Confirmed	1
SY-02	Every assistant user can run their own Python code on the server	Security	Critical	Confirmed	1
SY-03	Anyone can disable a supplier or replace product photos by uploading a file	Security	Critical	Confirmed	1
SY-04	The invoice CSV e-mail runs for every store sale and fails almost every time	Integrations	High	Confirmed	1
SY-05	Late store sales from ADP cause constant stock revaluation	Performance and reliability	High	Confirmed	2
SY-06	A customisation lets stock revaluation change values in closed periods	Stock, accounting and data	High	Confirmed	1
SY-07	A database script runs stock revaluation inside the web server	Performance and reliability	High	Confirmed	1
SY-08	Nothing stops the same ADP bill from being posted twice	Integrations	High	Likely	1
SY-09	Approving a PO to Agilitas India waits on the other system and saves half-way	Integrations	High	Confirmed	1
SY-10	Submitting a Service Receipt Note saves the goods receipt before the note is finished	Stock, accounting and data	High	Confirmed	1
SY-11	The cash discount tool applies the full discount to every linked receipt	Stock, accounting and data	High	Confirmed	1
SY-12	Purchase Order grand total is replaced by the cash-discount amount	Stock, accounting and data	High	Likely	1
SY-13	Tax-template logic adds about seven database look-ups per line, several times per save	Performance and reliability	High	Confirmed	2
SY-14	Any user who can read a PO can send an approved PO back to draft	Security	High	Confirmed	1
SY-15	PO item exports are written as public files without a permission check	Security	High	Confirmed	1
SY-16	A no-login web method can read any uploaded file, including private ones	Security	High	Confirmed	1
SY-17	A no-login web method can overwrite the rows of any Item Master Request	Security	High	Confirmed	1
SY-18	Any logged-in user can run a data-correction script on all past transactions	Security	High	Confirmed	1
SY-19	The replaced tax calculation breaks on a standard ERPNext recalculation path	Code and configuration	Medium	Confirmed	2
SY-20	`calculate_taxes_and_totals.calculate` monkey-patch swallows GST template errors	Code and configuration	Medium	Confirmed	2
SY-21	GST helper overwrites line UOM, description and HSN, persists a non-standard `item_tax_rate`, and leaves stale CGST/SGST on inter-state lines	Stock, accounting and data	Medium	Confirmed	2
SY-22	Pricing differs between desk (whitelisted overrides) and server/API (core); copied `get_item_details` has drifted	Stock, accounting and data	Medium	Confirmed	2
SY-23	Custom GL remarks are written with per-row UPDATEs after submit and lost on every GL repost	Stock, accounting and data	Medium	Confirmed	3
SY-24	Item save performs full scans (EAN, style code) and a broken sequence generator that loops `exists()`	Performance and reliability	Medium	Confirmed	2
SY-25	Document Audit Trail hook rewrites the full history on every save, with an unindexed lookup that ignores DocType	Performance and reliability	Medium	Confirmed	2
SY-26	Deploy pipeline goes to prod on every push to main without tests or lint, and wipes the RQ queue	Code and configuration	Medium	Confirmed	1
SY-27	Most configuration is not in source control; migrate re-applies the repo copy	Code and configuration	Medium	Confirmed	3
SY-28	Payment Entry override inserts with `ignore_permissions` and `flags.ignore_validate`	Stock, accounting and data	Medium	Confirmed	2
SY-29	CDMS job is not idempotent; "JE & LCV created" detection is imprecise	Stock, accounting and data	Medium	Confirmed	2
SY-30	ADP sends dates in the wrong format and 158 store sales were rejected	Integrations	Medium	Confirmed	1
SY-32	Whitelisted dead endpoint cancels and rebuilds every PCV; recreated PCVs get `posting_date=None`	Stock, accounting and data	Medium	Confirmed	1
SY-33	Integration Request Log: Olabi bearer token is sent to a per-record URL, `callback_function` is resolved with `get_attr`, and resend methods have no permission check	Security	Medium	Confirmed	1
SY-34	Guest SRN helper endpoints leak PO line pricing to anyone who knows the PO number and supplier id	Security	Medium	Confirmed	1
SY-35	Guest web forms (SRN, Supplier Onboarding, Item Master) accept unauthenticated submissions that drive internal workflows and outbound email	Security	Medium	Confirmed	1
SY-36	E-mail workflow actions: `confirm_action` signs the user but has no expiry and no state binding, logs the approver in without authentication, and the confirmation templates are missing	Security	Medium	Likely	2
SY-37	Anyone can register a new application against the AI assistant	Security	Medium	Confirmed	1
SY-38	`override_whitelisted_methods`: permission parity	Security	Medium	Confirmed	2
SY-39	Credentials and personal data at rest and in logs	Security	Medium	Confirmed	1
SY-40	Audit trail gaps (compliance)	Security	Medium	Confirmed	2
SY-41	Cancelled PO stays open in Olabi when the cancel happens before the create is sent	Integrations	Medium	Confirmed	2
SY-42	`custom_is_synced_olabi` copied on amend/duplicate, so amended POs never auto-sync	Integrations	Medium	Likely	2
SY-43	Retry/concurrency weaknesses in IRL processor	Integrations	Medium	Likely	2
SY-44	Full PO JSON posted by client for sync/dup-check; truncated body error	Integrations	Medium	Likely	2
SY-45	ZeroGrunt reads purchase orders through a full staff account	Integrations	Medium	Potential	1
SY-46	No reconciliation for any integration	Integrations	Medium	Confirmed	2
SY-47	Payment Request override may be shadowed by india_banking; PE draft inserted with ignore_validate	Integrations	Medium	Potential	2
SY-48	India Compliance API failures (1,562) not from custom code; scheduler stopped	Integrations	Medium	Potential	3
SY-49	Error messages show technical details to users	Security	Medium	Confirmed	1
SY-50	API keys are held by vendors and dormant accounts	Security	Medium	Confirmed	1
SY-51	Negative stock is allowed and the immutable ledger is off	Stock, accounting and data	Medium	Confirmed	2
SY-31	Custom depreciation job is never scheduled (name collision with ERPNext job); after_migrate stop targets a non-existent name	Stock, accounting and data	Low	Confirmed	3
SY-52	Hooks-imported AR report patch is non-deterministic across workers	Code and configuration	Low	Likely	3
SY-53	Redundant monkey-patch of `get_allowed_types_from_settings`	Code and configuration	Low	Confirmed	3
SY-54	Customer on_update tries to disable the customer but the flag is not saved	Stock, accounting and data	Low	Confirmed	3
SY-55	SLE `before_insert` loads the whole Delivery Note per SLE (lead re-check)	Stock, accounting and data	Low	Confirmed	3
SY-56	Hard-coded master names	Code and configuration	Low	Confirmed	3
SY-57	Synchronous SMTP inside Payment Request `on_update`	Performance and reliability	Low	Confirmed	2
SY-58	Integration callback robustness: None callback; PR `mark_as_synced` can never succeed	Integrations	Low	Confirmed	2
SY-59	DN/PR/SO override `before_insert` without `super()`	Code and configuration	Low	Confirmed	3
SY-60	Integration whitelisted methods without permission checks	Security	Low	Confirmed	2
SY-61	IRL logs unbounded; response headers stored; no retention	Integrations	Low	Confirmed	3
SY-62	Item → Olabi sync on every variant save; payload crash/“None” strings	Integrations	Low	Confirmed	3
SY-63	Consolidated report window resets every January; unbounded body	Integrations	Low	Confirmed	3
SY-64	ADP Integration doctype unused; inbound runs on generic REST with no inbound contract	Integrations	Info	Confirmed	3
SY-65	SOW integrations Shopify, Increff, Aegis, Databricks, Australia systems, Mochiko not in code	Integrations	Info	Confirmed	3
SY-66	SQL injection review: none exploitable	Security	Info	Confirmed	3
SY-67	GST and e-invoice paths touched by custom code (pointer for the GST auditor)	Code and configuration	Info	Confirmed	3
SY-68	Distribution leads not applicable	Code and configuration	Info	Confirmed	3

How to use this page

The short version

Findings by area

Ten things to know

What the audit covered

Security

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution

Status or dependency

Issue

Why it matters

Evidence and code

Suggested solution