A multi-tenant authorization vulnerability was discovered in a Department of Defense contractor, leading to zero tenant isolation and exposure of military training data. The responsible disclosure process took five months to complete.