---
title: "Discussion on \"One hyphen, two tenants, one signing key\" | Hashnode"
description: "Discussion on \"One hyphen, two tenants, one signing key\". Two of our tenants were quietly the same tenant: same database, same token-signing key, different names. The cause was a one-line helper that sanitized slugs by stripping hyphens, turning a unique identifier into a non-unique one. Here's how a lossy string transform became a cross-tenant takeover, and why we found it before you did."
url: "https://hashnode.com/posts/one-hyphen-two-tenants-one-signing-key/6a4d896be6305df7b8deb536"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [One hyphen, two tenants, one signing key](https://authagonal.hashnode.dev/one-hyphen-two-tenants-one-signing-key?utm_source=hashnode&utm_medium=feed)

Two of our tenants were quietly the same tenant: same database, same token-signing key, different names. The cause was a one-line helper that sanitized slugs by stripping hyphens, turning a unique identifier into a non-unique one. Here's how a lossy string transform became a cross-tenant takeover, and why we found it before you did.

Jul 7 · 6 min read · authagonal.hashnode.dev  
Read the article

-   [#authentication](https://hashnode.com/tag/authentication)
-   [#security](https://hashnode.com/tag/security)
-   [#multitenancy](https://hashnode.com/tag/multitenancy)
-   [#isolation](https://hashnode.com/tag/isolation)
-   [#saas](https://hashnode.com/tag/saas)

## Written by

[Sam Critchley](https://hashnode.com/@authagonal)

@authagonal

  
[View profile](https://hashnode.com/@authagonal)

The auth platform you migrate to.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.