WilliamACLove closes three paths to other tenants' data

The big one is a database-permissions oversight. Only the user-profile table had row-level access controls turned on. Every other table - projects, documents, chats, the AI-extracted excerpt grids, even folders - was reachable from the public web key that ships inside the browser app. In practice, anyone on the internet could query chat history and extracted excerpts across every tenant. Switching the controls on for the rest is enough to lock outsiders out without breaking legitimate server reads.

The other two are quieter. The endpoints that ask the model to pull fields out of a document stack were accepting any document ID supplied - including ones belonging to another tenant. And folder-move handlers weren't checking that the folder lived in the project being edited. Both now verify ownership before any work happens.