Team invitation flow is clearly presented
Why it matters
A buried or broken invitation flow directly limits expansion revenue in any multi-user SaaS. If an invited user clicks an email link and sees a 'User not found' error instead of a signup prompt, that seat is lost — and the inviter loses confidence in the product. CWE-284 (improper access control) applies when the invite acceptance route fails to redirect non-users to registration, effectively creating a dead end that prevents legitimate account creation through a valid access path.
Severity rationale
Medium because a broken invite acceptance flow causes direct seat loss and inviter trust damage, but doesn't create unauthorized access — the failure is exclusion, not intrusion.
Remediation
In the invite acceptance handler at src/app/invite/[token]/page.tsx, redirect non-users to signup with the invite context preserved:
const invite = await getInviteByToken(token);
if (!invite || invite.expiresAt < new Date()) notFound();
const user = await getUserByEmail(invite.email);
if (!user) {
redirect(`/signup?email=${encodeURIComponent(invite.email)}&invite=${token}`);
}
await acceptInvite(invite.id, user.id);
redirect('/dashboard');
Also add an 'Invite teammates' entry to src/components/Sidebar.tsx reachable within 2 clicks of the dashboard — users shouldn't have to dig through settings to find it.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Onboarding UX Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-284 — Improper Access Control
Taxons
History
- 2026-04-18·v1.0.0·Initial import from saas-onboarding·automated