graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

remove already-fixed H25 from bugs.md

Browse source
This commit is contained in:
Graham McIntire 2026-05-12 11:47:16 -05:00
parent 8379664cb0
commit 8eb8334459
1 changed files with 0 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
bugs.md
View file

@ -96,18 +96,6 @@
---
### H25. No Device/Site Organization Validation on Check Creation
**File:** `lib/towerops_web/controllers/api/v1/checks_controller.ex:47-60`
**Severity:** HIGH — Check can reference devices from other organizations
**Description:** Only `check_type` is validated. The `device_id` is not verified to belong to the authenticated org.
**Fix:** Add device access verification using `ScopedResource.fetch/3`.
---
## MEDIUM
### M1. Resource Scoping Reveals Org Membership