IonWarpbotcommented 2 min agoIonWarp Review — PR #87
3 issues| 2 P0 1 P1
#SevIssueFile
1Request ID lets a member read another workspaceapi/projects/[id].ts
2Provider secret included in the public client bundleapp/config.ts
3Unsigned webhook can enqueue account actionsapi/webhooks.ts
api/projects/[id].ts
42434445
−+++
const project = await projects.get(params.id);const project = await projects.getForMember({projectId: params.id, userId: session.user.id,});
A signed-in user can cross the workspace boundary · Security Review
The endpoint authenticates the caller but never binds the requested project to their membership. Changing the URL ID returns another workspace’s private project. Resolve membership before returning it.
Suggested fixAI fix prompt