Known Defects List

Exhibit to the Beta Participation Agreement, Section 1.4. "Provider gives it a written list of the defects then known to Provider that could affect the confidentiality, integrity or availability of Participant data."

A.1 -- Cross-firm isolation (NC-20)

Ten handlers in the mock-trial module read the organization identifier from the request rather than from the session, and the flag that governs this is on by default. A user session for one Firm can, through those handlers, reach records that belong to a different Firm.

Status: Confirmed fixed. Joshua Burac confirmed on September 9, 2026 that this defect is fixed as of the commit currently running in production (a5198f2, merge of PR #8935, September 9, 2026), which includes PR #8644 (ML101-2630, merged September 4, 2026): the guard requireOrderInCallerOrg is mounted unconditionally on /orders/:id and /invoices/:id/paid, reads the caller's organization from the database, returns 404 on any cross-firm mismatch, and does not depend on any feature flag.

Why it matters for the Beta specifically: before the Beta there was no customer, so this defect could not cause harm. The Beta puts several Firms on the same backend at the same time with real client records, which is exactly the condition this defect needs to cause harm.

A.2 -- Duplicate expert payments (NC-21)

The payment to an expert or consultant is relaunched every thirty minutes while the transfer is in flight, and two refund paths can together return more than the original amount.

Status: Confirmed fixed. Joshua Burac confirmed on September 9, 2026 that this defect is fixed as of the commit currently running in production (a5198f2, merge of PR #8935, September 9, 2026), which includes PR #8070 (ML101-2227) and PR #8081 (ML101-2231), both merged August 28, 2026: the expert or consultant payout is no longer re-sent while a transfer is settling, and refund headroom is held before money moves.

Why it matters for the Beta specifically: the Beta will charge and pay expert engagements for real.

A.3 -- Lockout after five attempts (NC-22)

The failed-attempt counter is not atomic, so concurrent attempts never reach the lockout threshold.

Status: Confirmed fixed. Joshua Burac confirmed on September 9, 2026 that this defect is fixed as of the commit currently running in production (a5198f2, merge of PR #8935, September 9, 2026), which includes PR #8083 (ML101-2236, merged August 28, 2026): the failed-attempt counter is now atomic, so the lockout arms under concurrent attempts.

Why it matters: Annex II of the Data Processing Addendum promises customers a "5-attempt lockout." This is why that defect needed the fix confirmed above before that sentence in Annex II could be treated as accurate.

A.4 -- Expired financial approvals not enforced

The routine that expires a stale financial approval is never invoked, and there is no database backup for it.

Status: Confirmed fixed. Joshua Burac confirmed on September 9, 2026 that this defect is fixed as of the commit currently running in production (a5198f2, merge of PR #8935, September 9, 2026), which includes PR #8095 (ML101-2242, merged August 29, 2026): an expired payment request can no longer pay the invoice, because expiry is enforced at the point where the payment decision is made.

A.5 -- Production build currency

Status: Confirmed current as of September 9, 2026. Production runs commit a5198f2 (merge of PR #8935, committed September 9, 2026, 11:01:44 UTC; rolloutState COMPLETED on both the backend and frontend services). The June 12, 2026 merge cited in the August 28, 2026 briefing is no longer running in production. The remediation fixes for A.1 through A.4 above are each part of this build, and Joshua Burac has confirmed each of them fixed as of this same commit and date.

What this list is not

This list states what Provider knew as of the date above. It is not a representation that these are the only defects that exist, and Section 1.4 of the Beta Participation Agreement requires Provider to add to it, within seventy-two hours of learning of it, any further defect found during the Beta that could affect the confidentiality, integrity or availability of Participant data. Provider keeps each version of this list.