> It sounds more to me like an access control/authentication failure - firstly on listing recordings that belong to another user, secondly on then giving access

> It sounds more to me like an access control/authentication failure - firstly on listing recordings that belong to another user, secondly on then giving access to those recordings when requested. Yep, I agree. Perusing their careers page, I can see they use ruby and java. It’s so easy to misconfigure resource authorization in a rails app, which is why it’s so important to have solid testing around those components of an app. > I guess this gives rise to a bigger question around whether online GP consultations should be recorded and preserved like this I also completely agree here. EMR systems are well established at this point and doctors have somehow gotten this far without needing full recordings of most consultations. It wouldn’t surprise me if they were developing an abridgment system that automatically creates notes for doctors or something, but like you said, storing that training data is such a huge risk.