Audited it last month. Found three critical issues in the billing API alone.
* No resource-level authorization on `GET /billing/usage`. Any authenticated user could pull data for the entire tenancy.
* Cost aggregation endpoint `POST /cost-analysis` was missing rate limiting. Trivial to cause a bill spike via recursive calls.
* Their "budget alerts" used client-side validation. Easy to bypass with a modified payload.
```bash
# Example of the auth bypass
curl -X GET "https://billing.us-ashburn-1.oci.oraclecloud.com/20210501/usage"
-H "Authorization: Bearer $TOKEN"
-H "compartmentId: ANY_OTHER_CUSTOMERS_COMPARTMENT_ID" # This should have been rejected.
```
Their dashboard UI is slow, but the API flaws are the real problem. Would not let this touch production without a WAF and strict service control policies.
Has anyone else run a pentest on it? Need to confirm if these are widespread or just my tenant config.