- Shipped
- August 24, 2026 at 11:45 PM UTC
- Author
- Kamo
- Commit
- d09bd5d
login.kamocrm.com is the sign-in screen for every organization that has no host of its own, so the hostname cannot say which one is signing in. ?org= does: it names the organization by id or alias, selects the branding to paint, and travels with the credentials as the organization they are checked against. A hint, not a credential. Membership is proven server-side either way, so naming an organization you do not belong to gets the same refusal as naming a fictional one. The worst a wrong reference achieves is the wrong logo on a public page. Branding comes from SecurityService's /org/public/{ref}, relayed rather than reimplemented so the rule about what a guessable reference may expose stays in one place. The theme base then follows the organization instead of the host, used as given: dropping its first label the way the host path does would turn acme.kamocrm.com into kamocrm.com and paint a tenant in the platform's branding. The first paint necessarily uses the host's branding, because the reference has not been resolved yet; KAMO_THEME_REAPPLY repaints once it has. A visit that names no organization clears any reference a previous visit recorded in this tab, so the platform's own screen does not keep someone else's logo.