PR #212Octopoda found 1 critical issue. Check failed.
CriticalProvenAny signed-in user can read other customers' invoicesapp/api/invoices/[id]/route.ts:14GET /api/invoices/inv_10482 as account B 200 OK , should be 404
Copy fix promptfor Cursor or Claude Code Every finding is reproduced before it is reported, and comes with a fix you can paste into your AI tool.