IonWarpbotcommented 15 min agoIonWarp Review — PR #87
const project = await projects.get(params.id);const project = await projects.getForMember({projectId: params.id, userId: session.user.id,});
A signed-in user can cross the workspace boundary · Security Review
The endpoint authenticates the caller but never binds the requested project to their membership. Changing the URL ID returns another workspace’s private project. Resolve membership before returning it.