The id resolver never hands a campaign an address the member can't read

FixSecurityService
Shipped
September 12, 2026 at 8:56 PM UTC
Author
Kamo
Commit
3b2d72f

Resolving lead ids read each address through the lead masking DTO and skipped only blank ones. Masking now obfuscates instead of blanking ("s*****@gmail.com"), so a masked lead's address went straight into the send list. It now decides readability first — the lead screens' own rule: god reads all; no View Leads, no leads; your own leads; anyone else's with View contact info of others, and an unassigned one only if you can also see it (View unassigned leads, or a free-for-all product) — and skips what it can't read as masked. Accounts now need View Accounts and applications a loan pipeline, as their screens do; before, any member with Manage Bulk Email could pull either by id.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing