- Shipped
- September 7, 2026 at 10:52 PM UTC
- Author
- Kamo
- Commit
- 951fdf1
The board is global — every organization sees every report — and what protects a customer is SystemBugIdentityPolicy withholding WHO filed a row. A control that lists reporters by name is that same disclosure arriving through a different door, so it is offered to exactly the population the policy already discloses everything to: term 1, a TeamMember of the platform organization. Reused rather than respelled, and a plain Member of that org is refused with it — "works at the platform org" and "may read customer identities" are different populations, which is the distinction the policy exists to draw. GET /reporters is refused outright to everybody else, because an empty list is a fact about the board and this is a fact about the caller. ?reporterId= on the listing is IGNORED rather than refused, following includeVoided — a stale filter in a bookmark is not an attack. Ignoring is what matters here, not politeness: every row on this board is already visible to everybody, and a listing that honoured the parameter would answer "which reports did member 1170933975273603078 file?" for anyone who asked, which is precisely how an alias:2 on a card gets resolved back to a person. statusCounts now takes the caller rather than their id — it needs their TYPE for the same gate — and carries the reporter through, so the number beside a status keeps promising what picking it would show. The list response gains canFilterByReporter so the console draws the control from the server's answer. A second copy of a disclosure rule in the browser is how a name reaches a surface the server withheld it from.