Jobcoin Clock-in Program

Findings · 3

1. 1 Clock-in denial of service via pre-created ATA Informational
2. 2 Stale token balance is logged after CPI and after closing the account, which can mislead monitoring and incident response Low
3. 3 Early‑withdrawal penalty rounds down, enabling penalty minimization via small splits Informational

Findings extracted from the published report PDF. See the full report below for details and remediation.