Important security advice from Henry Arnold to anyone selecting an invoice processing product https://lnkd.in/eAbf7Xsm
More #payments products are adding #OCR to read supplier #invoices. Nook still has important features that a missing from these competitor products including line item extraction. But what is often hidden to users are important security features. Invoices are hopefully sent from trusted suppliers. However, suppliers systems can be attacked or attackers can impersonate a supplier. Everyone is familiar with classic attacker who visibly changes bank account details. However, other attacks are possible. Attackers can embed JavaScript in PDFs or images. If the application renders the file in the frontend end they are vulnerable to cross site attacks. This could allow a bad actor to change bank details with an API call. For this reason we re-encode all files we receive. We are aware some of the new competitors do not take this important step. If you would like to test a product download the file the product renders and compare it with the file you sent using the Python code I have left in the comments.