- Shipped
- August 2, 2026 at 6:38 PM UTC
- Author
- Kamo
- Commit
- 7c9d667
The handler was declared backfillConversions() — it took no request at all — under the comment "No auth — internal maintenance, mirrors /backfill-thumbnails". It scans **************** 500)) across every tenant and converts document bytes, so an anonymous caller could drive work over other organisations' documents. Every sibling upload handler in this controller already gates on extractKToken(request); this one never did. The sweep stays deliberately platform-wide. Restricting it to platform staff needs a god-mode signal in this service and belongs with the deny-by-default authorization work.