A reply quoting a contact names the contact, not the connection owner
A social contact has no member row, so everything they send is stored under the connection owner's member. The history read already names such a row as the cont...
Re-check clearance when rendering a binder's document items
BinderItem pins the Img row it was built from at assembly time. BinderRenderer.renderItem handed that Img straight to **************** with no check at all for ...
A From override must be an address the caller may send as
POST /api/email/send took request.getFromAddress() straight into the header From and the SMTP envelope sender **************** -> EmailSmtpService.send, and the...
Cap upload size and concurrent conversions on the unauthenticated pipeline endpoints
POST /convert-vector and WS /ws/pipeline take no auth (see this commit's companion report for why that is not fixed here) and, until now, read a caller's whole ...
The SOCIAL read gate refused every social session, not just cross-org ones
Regression in f7b2bd5, live on kamowsmedia. canReadSession (MediaController, copied into SessionFacesController and ChatSessionMembersController) admitted a mem...
Stop trusting any https://api.<anything> as a Docs WOPI host
k8s/Docs-deployment.yaml's aliasgroup1 was 'https://api\..*'. Docs's alias matcher (RegexUtil::getValue, std::regex_match) requires only that the WHOLE candidat...
A media presigned URL was not scoped to the caller's org
GET /api/kb/media/{mediaId}/url looked the row up by uid alone (KbMediaService.getPresignedUrl -> **************** unlike every other media read here (presignAl...
WebRTC signaling, webinar management and Canva schedules stop trusting the caller's say-so
Three more of the same shape. - WebRTCSignalingController relayed **************** straight to **************** using only the payload's own sessionGuid, w...
Gate chat attachments, voicemails and call recordings by more than org+clearance
MediaService/telephony store chat attachments (CHAT_ATTACHMENT) and voicemail/call recordings (VM_RECORDING, CALL_RECORDING) at ACCESS_LEVEL 0. Every generic im...
The member card can be reached from the keyboard
The card is portalled to the end of <body>, so in document order it follows the whole page: a member who opened it from a name with Enter or focus and pressed T...
No job overlaps itself, and no HTTP call can hang a worker forever
Quartz here runs 10 in-memory worker threads on one replica. 17 of the 24 jobs had no @DisallowConcurrentExecution, so a run that overran its interval started a...
The lead-intake counters join the ledgers the daemon folds and recounts
The intake endpoints' received / imported counters are now a ledger (securityservice create_lead_intake_ledger.sql, applied 2026-09-22): a trigger on lead_intak...
Intake endpoints show exact received/imported counts from the intake ledger
The Lead Intake settings list showed total_received / total_processed / last_received_at straight off the endpoint row, where they were bumped once per payload ...
Intake endpoint counters come from a ledger and stop losing updates
**************** / total_processed / last_received_at were bumped on the endpoint row itself: once per inbound payload (~5/s during a farm import) and once per ...
Refuse to spawn STDIO for an unlisted config, and refuse to connect an SSE/HTTP one to the cluster network
Defense in depth alongside the AIService commit that closes AiMcpController's missing right checks and STDIO refusal at the source: this service is the one that...
MCP configs need MANAGE_AI_SETTINGS, provider/MCP urls can't reach the cluster, quota policies are enforced
Three independent findings, fixed together because the first two share files and a class. 1. AiMcpController had zero right checks on create/update/delete/test...
Session reads, ticket mutations and public keys stop trusting the caller's say-so
Four related holes, all the same shape: a request carried an authenticated member, and that was treated as enough. - **************** SessionFacesController.fa...
Bind every WOPI endpoint to the document its token was minted for
CheckFileInfo was the only WOPI endpoint that both compared the access token's document against the request path and re-checked live access; GetFile, PutFile, P...
The session path searches the caller's own org, never the request body
RagSearchController read orgId/memberId/memberType from the JSON body on every path, including requests authenticated by a *** session rather than X-Internal-Au...
Give the postbuild compression probe more time to start the server.
Docker builds can still be settling after prerender workers finish; extend upstream and probe waits and surface child stderr when startup fails.
Lower the floating logo by 3px.
Reduce NAV_LOGO_RISE from 10 to 7 so the mark sits slightly lower while keeping shared chrome math in sync.
Stop double-counting banner height on secondary pages.
Body already reserves the preview strip; main padding now clears only the nav row and logo overhang so inner pages do not stack a second chrome band.
Move the floating logo outside the header containing block.
backdrop-filter on the header trapped position:fixed children so top and margin offsets never moved the mark; pin it to the viewport instead.
Move the floating logo up with marginTop instead of top calc.
The dynamic top calc was not shifting the mark; mirror nav-row flex centring and pull it up 10px with marginTop.
Pin the floating logo top edge for a reliable vertical offset.
Stop relying on translateY(-50%), which was not moving the rendered mark, and place the logo 10px above nav centre explicitly.
Correct the floating logo vertical offset.
Anchor the mark 10px above nav center instead of shifting it down with a transform miscalculation.
Float the logo above the preview banner and raise it 10px.
Use fixed positioning so the mark escapes the nav header stacking context and paints over the red strip.
Show the correct draft batch total before send
Draft batches keep totalAmount at zero until send — it is a post-send snapshot, not a running total — so the compose UI now sums line amounts for the KPI tile a...
Normalize memberId when relaying line add/update requests
The browser keeps member ids as strings to avoid IEEE-754 rounding on CockroachDB unique_rowids. Normalize to Long before relaying so the credit lands on the in...
Aliases and shared-mailbox access name their members as text
GET and POST /api/email/aliases (and /aliases/member/{id}) and GET and POST **************** answered with the entities themselves, whose Long memberId and gran...
A number's owner travels as exact text, so saving it no longer re-owns it
GET /api/voip/numbers wrote ownerMemberId as the entity's Long. A member id is an INT8 past 2^53, so the settings page read it rounded: the owner was never foun...
The account view names its primary member
GET /customers/{uid} sent the primary member only as primaryMemberId, while the account view reads a primaryMember object — so its Primary member row read "---"...
An article's version history draws, and names who edited each version
kbservice answers /articles/{guid}/versions with a Spring Page of its entity. The history component read the body as a list and called .map on the Page, so it n...
A face that opens a card has a name for a screen reader
A MemberHoverCard around a face alone was a focusable button with nothing to be named by. It takes an optional label, used only when the trigger has no text of ...
A document's history loads, and names the people on it and on its shares
GET /imaging/history/changes and /history/downloads built each row with Map.of, which throws on a null — and a row with no IPv6 address, no prior data or no mem...
An article's byline names its author, and opens their card
kbservice answers GET /articles/{guid} with its entity, so authorMemberId is a JSON number, and JSON.parse rounds a 19-digit member id. The article route compar...
The Enter that opens a card goes no further
A name's trigger handled Enter and Space but let the key bubble on, so a list around it that acts on Enter itself — the timecard approvals queue opens the membe...
A card opened in a tool window knows who is online
Presence and availability are provided inside AuthedChrome, but the ToolDock — every chat, ticket and social window, and the chats switcher — is mounted above i...
A name with no card to open draws no hover underline
MemberName drew its dotted hover underline even when the surface had no member id, so a plain name promised a card it could not open. The underline now comes on...
An account note names the member who wrote it, not "System"
GET /customers/{uid}/notes sent each note's authorMemberId but no authorName, and the account view shows a note with no name as written by the system — so every...
A client's message pops its window into the front row, not a strip behind it
Reported 2026-09-17: Ian wrote into his Exec2Exec chat and the desk never saw it pop up; it was found only by going into the Interaction Center. Nothing upstre...
The Webinars section reads the lead API that exists
It called /api/webinar/leads/{id}, which MediaService never served (live 404), and a 404 reads to this section as "the feature is off" — so it rendered nothing,...
The chat head menu acts on the person in the chat, not on the window id
A head's id is its window's id (`chat-3`), and the menu read it as the member it was a chat with. So it fetched /api/security/members/chat-3 — a 404 — and with ...
A meeting from a chat window invites the conversation, and one email goes to everyone
Starting a meeting from a conversation window's meet button, or from a chat hexhead's "Invite to Meeting", invited nobody. The dialog closed as though the invit...
The public demo page shows no one's contact details, and a site's key books only its own org
Demo requests from the marketing site come from visitors with no account. That path already needed none: the attendee row is the name and email the form collect...
My Scheduled Webinars and Join Existing read the booking the server actually sends
The Support badge now takes a presenter to My Scheduled Webinars when a session is booked with them (mediaservice 0212445). That tab — and the wizard's Join Exi...
The scheduler lists the org's webinar types, and a booking badges its presenter
/support/schedule-webinar said "No webinar types are currently available." for every organization, however many types it had. The wizard loads its picker from G...
Short one-time codes can no longer be guessed without limit
Every short code the platform mails or texts was checked with no count: - POST /api/recover/email/verify-code took the 8-hex-character reset code ALONE and mat...
No OAuth client secret in kamo-internal's source; the anonymous token route is gone
**************** assigned the client-credentials secret for four production client ids (kamo:1:crm:internal, kamo:4:kamo:internal, kamo:5:ebonix:internal, kamo:...
Integration forms send only the credentials that were typed
The org CalDAV/CardDAV tab sent all four server fields on every save of an Apple or custom server. The fields never show what is stored, so they were empty, and...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.