Skip to content

fix(notifications): scope rules to owner_id to prevent cross-tenant exfiltration (fixes #2064) #2067

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
namann5 wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix(notifications): scope rules to owner_id to prevent cross-tenant exfiltration (fixes #2064) #2067

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
20ba1b7
fix(notifications): scope notification rules to owner_id to prevent c…
namann5 Jul 23, 2026
91b2ed5
test(notifications): add two-owner regression tests for cross-tenant …
namann5 Jul 24, 2026
78c031e
fix(tests): fix saved_views auth rejection tests using no_auth_app_cl…
namann5 Jul 24, 2026
90d42f5
Merge branch 'main' into fix/cross-tenant-notification-exfiltration
namann5 Aug 4, 2026
44bbc77
Merge remote-tracking branch 'upstream/main' into fix/cross-tenant-no…
namann5 Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion backend/secuscan/notification_service.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -653,8 +653,10 @@ async def process_finding_notifications(
if not finding:
return []

owner_id = finding.get("owner_id", "default")
rules = await db.fetchall(
"SELECT * FROM notification_rules WHERE is_active = 1 ORDER BY created_at ASC"
"SELECT * FROM notification_rules WHERE is_active = 1 AND owner_id = ? ORDER BY created_at ASC",
(owner_id,),
)
results: List[DeliveryResult] = []
for rule in rules:
Expand Down