NoSQL Injection Patterns: 7 Checks for Query Types, Tenant Scope and Evidence
Review NoSQL input from the request parser through the final executed query. Record casting, dropped keys and tenant restrictions separately, and use observed authorization outcomes rather than a rejected payload or unusual response as the conclusion.