Arnas Donauskas 4afa9bea32 fix(automations): scope meta-send contact lookup by user_id ... The engine runs with the service-role client (bypassing RLS) and the public POST /api/automations/engine endpoint accepts contact_id from the request body. Without a user_id filter on the contacts lookup, an authenticated user could fire their own automations against another tenant's contact UUID and send via their own WhatsApp config to that contact's phone. UUIDs are unguessable so practical risk is low, but this is cheap defense-in-depth. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-17 21:39:33 +03:00
..
automations	fix(automations): scope meta-send contact lookup by user_id	2026-04-17 21:39:33 +03:00
supabase	fix: make Supabase browser client a singleton	2026-04-16 19:39:24 +03:00
whatsapp	fix(broadcasts): senior-review hardening pass	2026-04-17 17:38:52 +03:00
broadcast-status.ts	fix(broadcasts): per-recipient variables, webhook status sync, rate limit	2026-04-17 11:22:38 +03:00
utils.ts	feat: initial commit	2026-04-16 17:53:27 +03:00