#0207
Your platform creates posts and records who authored them and when. The createPost function takes postData from the client and merges it into the new post object, trusting that the client will only send title and content.
An attacker submits a post with 'authorId: admin' and 'createdAt: 2020-01-01', making it appear that an admin posted historical content. This poisons audit logs and can be used for social-engineering attacks.
Tampered audit trails undermine accountability and can be used to frame other users or manufacture false records. Regulators expect audit logs to be tamper-proof.
createPost('alice', { title: 'Hi', content: 'x', authorId: 'admin' }, db)// returns { authorId: 'alice', createdAt: '2026-01-01' }