You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Thomas Joise 54cde7961b fix(sec/d24): gate destructive/sensitive ops to managerial ... Red-team authorization findings: - New requireManagerial middleware. Applied to POST /documents/:id/cancel, /credit-note (financially destructive — reverse money / consume a number) and /documents/:id/share (mints an UNAUTHENTICATED public PDF link — the IDOR exfiltration high). Any signed-in staff could previously do all three. - PATCH /interactions/:id now 403s unless the viewer is the interaction's author or managerial — staff can no longer overwrite another employee's logged call/visit. New authz-gates test locks both. Note (deliberate): general client read/edit stays open to staff — a shared support-team book is the intended model; the genuinely sensitive credential reveals are already managerial + rate-limited. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		4 days ago
..
hq	fix(sec/d24): gate destructive/sensitive ops to managerial	4 days ago
hq-web	feat(d22): P2 — onboarding checklist per project + Projects (Onboarding) board	4 days ago