IonWarpbotexample reviewconst project = await projects.get(params.id);const project = await projects.getForMember({projectId: params.id, userId: session.user.id,});
The endpoint authenticates the caller but never binds the requested project to their membership. Changing the URL ID returns another workspace’s private project. Resolve membership before returning it.
