Back to blog
HR Techpayrollstorage

Payslip PDFs: where teams get storage wrong

Published on 2026-04-164 min readFlorian

The most sensitive file in the product, often the worst kept

A payslip carries identity, salary, partial bank details, social security number. Yet it often sits in a misconfigured bucket.

For more — see our our HR tech security offer.

What we keep seeing

  • Supabase or S3 bucket public "for simplicity";
  • signed URLs with long expiry, shared over email;
  • access control only in the frontend, no server rule;
  • predictable filenames (payroll-2026-04-employee-123.pdf).
  • The right question

    If someone guesses the URL of another employee's payslip, what happens? The answer should be: nothing. If it isn't immediate, an audit is overdue.

    For HR & Payroll vendors

    CleanIssue specializes in security reviews for HR, payroll, and recruiting software. If you're building an HRIS, payroll tool, or ATS and want an external review of your exposure before a client audit or security questionnaire, see our offer for HR & Payroll vendors.

    Go further

    Related articles

    Three adjacent analyses to keep exploring the same attack surface.

    Sources

    Written by Florian
    Reviewed on 2026-04-16

    Editorial analysis based on official vendor, project, and regulator documentation.

    Related services

    If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.

    Need an external review of your HR SaaS?

    Share your product, stack, and client context. We will come back with the right review scope.

    Discuss your audit