Use Repo.get_by(schema, id: id, organization_id: organization_id) instead of Repo.get + pattern match so that resources from wrong orgs return :not_found instead of :forbidden, preventing org membership discovery.
The API was silently stripping site_id when use_sites was false, causing the Terraform provider to report inconsistent state after apply.
Implemented tests for critical security modules with significant coverage improvements: - ApiAuth plug: 0% → 100% (12 tests) - Permissions module: 0% → 85% (32 tests) - Devices API controller: 0% → 95% (22 tests) Enhanced test fixtures to support membership roles and device creation with proper organization scoping.
