Scope public API endpoints to caller visibility (GHSA-6ghm-wf22-pvx5)#367

Draft

jbrooksuk wants to merge 3 commits into

mainfrom

security/api-visibility-scoping

Commits on Jul 8, 2026

Scope public API endpoints to caller visibility (GHSA-6ghm-wf22-pvx5)

jbrooksuk
and
claude
committed
Resolve API callers through the Sanctum guard and scope relationship includes

jbrooksuk
and
claude
committed
Assert hidden group includes by resource type to avoid faker name collisions

jbrooksuk
and
claude
committed