fayerman-source walls off one project's folders from another
A handful of folder and document actions trusted IDs from the browser without checking they belonged to the project you were actually in - and now they don't.
Mike lets teams organise documents into project folders. But a few actions - moving a folder, deleting one, moving a document into a folder - took a folder ID straight from the browser and acted on it without first confirming the folder belonged to the project you were working in. In a workspace holding several clients' or matters' files side by side, that's a real gap: an ID pointing at another project's folder could quietly reach across the divide and, in the delete case, even strip documents loose from the wrong project.
fayerman-source closed it by scoping every one of those lookups to the current project. A mismatched ID now simply fails instead of touching anything it shouldn't. Backend-only, small, and the kind of fix you don't notice until it isn't there.
Spotted something wrong? Or know the PR text has fresher detail than the writeup above?