Tenant boundary missing from project lookup

A URL-controlled project ID reaches a record lookup that is not visibly constrained to the active organization.

app/api/projects/[projectId]/route.ts:4286% evidence confidence

Evidence

01 / sourceUntrusted inputrequest.params.projectId

02 / controlVisible guardrequireSession(request)

03 / sinkSensitive operationprisma.project.findUnique({ where: { id } })

Evidence boundaryStatic evidence only. Runtime reachability, hidden policy layers, and exploitability require human-controlled validation.

Agent recommendation

Provisional and evidence-bound

Suggested dispositionValidate

The code path has session authentication but no visible tenant predicate. Human validation must confirm that project IDs are obtainable and no repository-level policy is hidden.

Hardening directionBind the lookup to session.organizationId and add negative tests using two tenants with cross-owned project IDs.

Human decision

Not exposed to agent tools

Reviewer rationale required

Audit log

Append-only view

agent

Imported three structured candidates

09:41:08

system

Authorization and synthetic scope verified

09:41:02