fix(security): close cross-tenant IDOR gaps in OAuth credential and execution auth - #4549

Merged

waleedlatif1 merged 8 commits into

fix/security-idor-auth

May 11, 2026

Commits on May 10, 2026

fix(security): close IDOR gaps in OAuth credential and execution authorization
waleedlatif1
committed
1cdb3c6

Commits on May 11, 2026

fix(security): close verifyFileAccess bypass, thread workflowId to processQueuedResumes, fix log level
waleedlatif1
committed
94bc2e2
fix(security): thread workflowId through all processQueuedResumes call sites
waleedlatif1
committed
fd234ac
fix(security): remove any types, drop extraneous comments, normalize caught errors
waleedlatif1
committed
0d4c9c6
fix: use logger.warn for credential access denial in outlook folders route
waleedlatif1
committed
eb1cf3f
fix(security): make workflowId required in all HITL pause/resume methods
waleedlatif1
committed
a60057a
fix(security): thread workflowId through internal HITL cancellation calls and remove dead branches in credential-access
waleedlatif1
committed
86f3a53
fix(security): harden workflowId scoping and file key guard
waleedlatif1
committed
026405f