diff --git a/bugs.md b/bugs.md index 94644a25..5eb67a56 100644 --- a/bugs.md +++ b/bugs.md @@ -96,18 +96,6 @@ --- -### H25. No Device/Site Organization Validation on Check Creation - -**File:** `lib/towerops_web/controllers/api/v1/checks_controller.ex:47-60` - -**Severity:** HIGH — Check can reference devices from other organizations - -**Description:** Only `check_type` is validated. The `device_id` is not verified to belong to the authenticated org. - -**Fix:** Add device access verification using `ScopedResource.fetch/3`. - ---- - ## MEDIUM ### M1. Resource Scoping Reveals Org Membership