Correctness, scale & PII hardening in LeadImportController

FixSecurityService
Shipped
July 2, 2026 at 2:00 AM UTC
Author
Kamo
Commit
b94ec36

- dedup via scoped LeadRepository query instead of findAll() over all tenants (was an OOM/DoS + cross-tenant exposure risk, re-run per 1000-row batch) - cap import at 100k rows and reject empty payloads - run transformations before the empty-skip so a defaultValue transform can fill blanks - honor transformation order; lenient boolean parse (1/Y/Yes/T/X); sanitize currency ($, commas) in loanAmount/propertyValue - stop double-counting duplicate rows as imported (processed = imported+duplicates+errors) - stop echoing raw exception text / stack traces (may embed lead PII) to client and logs

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing