- Ya
- 2 Agosti 2026, 18:38 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 7c9d667
The handler was declared backfillConversions() — it took no request at all — under the comment "No auth — internal maintenance, mirrors /backfill-thumbnails". It scans **************** 500)) across every tenant and converts document bytes, so an anonymous caller could drive work over other organisations' documents. Every sibling upload handler in this controller already gates on extractKToken(request); this one never did. The sweep stays deliberately platform-wide. Restricting it to platform staff needs a god-mode signal in this service and belongs with the deny-by-default authorization work.