Northwind Expenses (synthetic sample)
Method LM-I-1.2 · staging.northwind-expenses.example · revision a41c9e2 · completed 8 Oct 2026
Decision
Fix before rollout
Site-secure seal
Withheld
A public “site seguro” mark is refused. A private quote is also withheld until every material layer is recorded and every Critical, High, and Medium finding is fixed.
- Public surface is not in this review.
- Network exposure is not in this review.
- Differential authorization was named and still has a row that is not tested, blocked, or inconclusive.
- Business sequence was named and still has a row that is not tested, blocked, or inconclusive.
- Integrations was named and still has a row that is not tested, blocked, or inconclusive.
- LQ-02 (High) is Still present.
- LQ-03 (Medium) is Awaiting retest.
- LQ-05 (High) is Awaiting retest.
- Liquid does not issue a public site-secure seal.
What you can send
Liquid has not issued a site-secure seal for Northwind Expenses (synthetic sample) (8 Oct 2026). Stated use: Internal expense submission and approval for up to 40 employees. Do not publish this as a secure-site mark. Public surface is not in this review. Network exposure is not in this review. Differential authorization was named and still has a row that is not tested, blocked, or inconclusive. Business sequence was named and still has a row that is not tested, blocked, or inconclusive. Integrations was named and still has a row that is not tested, blocked, or inconclusive. LQ-02 (High) is Still present. LQ-03 (Medium) is Awaiting retest. LQ-05 (High) is Awaiting retest.
What was checked?
10 named workflows across 2 roles (Manager, Staff) in staging with synthetic data. 1 not tested, 1 blocked by scope.
What needs action?
3 reproduced issues remain open, led by role checks that only exist in the interface. 1 check is inconclusive.
Is the stated use ready?
Not yet. "Internal expense submission and approval for up to 40 employees" should wait until Staff can no longer read or approve other employees' expenses.
> liquid.explaining
This decision covers staging on 8 Oct 2026 for the stated use only. It isn't a statement about production or about integrations we didn't test.J. Okafor (Analyst) · reviewed by M. Silva (Security Lead)