A booking or registration is always a new record in the caller's practice; SI note drafts say so; billing reads write the PHI trail (SITP TP23)
- SchedulingService.book: the body is the entity, so a uid in it made save() a merge onto that appointment in ANY practice (and moved it into the caller's); s...
Subscription records, market lists and order notes reach only the caller's organization (SITP TP17)
SubscriptionService reads a subscription, its order, invoice and agreement by uid alone, in any tenant. POSController now checks the record is the session organ...
State licences are read and replaced only within the caller's organization (SITP TP16)
GET/PUT **************** found the member by id alone, so a holder of STATE_LICENSING_VIEW_ALL / EDIT_ALL in one organization could read, replace or delete anot...
Rights on the session-only controllers, with the grant backfill (SITP TP01)
@RequireRight (any-of, tenant RoleRightType) enforced by TenantRightInterceptor before the handler, the tenant counterpart of @RequirePlatformRight: no session ...
Rights on the lead doors the SI tools use, and the caller's own callbacks due (SITP TP10)
- PUT /leads/{id} takes EDIT_LEADS; a create that assigns someone else takes ASSIGN_LEADS - the lead pool (/leads/available, /leads/accept) takes VIEW_LEADS or ...
Patient-merge hooks run after the merge commits, so a failing hook can neither undo nor poison it
CreateClaim writes charge and units, sets the claim total, refuses a blank payer
Run the sign-in detection rules, and make their responses real
SuspiciousDetectionService was injected into SecurityController and evaluate() was never called, so every rule an organization configured on the Security screen...
Encrypt legacy signing secrets at boot; a refused target URL is a 400
The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable...
Seal Google/Microsoft calendar OAuth tokens at rest; re-seal legacy rows at boot
GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the ent...
Save answers before the rights fan-out, not after it
Saving a security model (e.g. its Default Security Roles) re-seeded and recalculated member rights for every org using the model before it responded. A model sh...
The profile save stores the member's address
The My Profile Address card posted { address, addressDetails, locality, subdivision, postalCode, country } and PUT /members/{id} never read the key, so every sa...
The guided-tours read answers the member's CURRENT Show Tour rights
A session carries the rights it was issued with and the routine refresh does not re-read them, so everyone signed in before the Show Tour rights existed saw no ...
The boot-time rights sync inserts a role's missing rights in ONE statement
b8014ab3's deploy never became ready. The 31 Show Tour rights made the row-at-a-time insert loop 31 YugabyteDB round trips per role — ~3.5 s a role, ~490 s acro...
An SI's charter read is retried on a YugabyteDB conflict instead of answering 503
GET **************** (I1) resolves the charter in one read-only transaction of 15-25 queries. One "Restart read required" (40001) answered 503 CHARTER_UNAVAILAB...
The lead page names its Vendor and Product
Lead.vendorProduct is @Transient — only VENDOR_PRODUCT_ID is a column — so nothing loads it unless someone asks, and LeadDTO.fromLead then leaves vendorProduct,...
A change to a member's teams is on the security access log — one SECURITY_SETTING_CHANGE/MEDIUM row per member who joined or left, from the team, the member's profile, a deleted team or creation (KamoCollab CP01 final review I1)
A team is a level of the rights waterfall, so joining one is a grant (CP01-T14-1). The department and job-title change on the same Position card writes an acces...
Pin the heads' names query onto users_pkey — /*+ IndexScan(u users_pkey) */ first in the statement, as loadMembers and the org chart's people query; without it the legacy planner seq-scans all of users per head row (KamoCollab CP02 final fix)
Production EXPLAIN (sp00verify, read-only): the unhinted literal plan was a nested loop over Seq Scan on users (106 rows) for 1 and 2 ids; with the hint every p...
The failed-recalculation log names the repair path as /teams/{id}/recalculate-rights
SLF4J has no brace escape, so "{{id}}" was logged literally. "{id}" is not a placeholder and prints as written; the test now pins the path an operator would typ...
A created member's activation welcome waits for the commit, so a swallowed 40001 can no longer turn the create into a silent rollback
POST **************** answered 200 with a member id and a user id that never existed (KamoCollab CP00 Task 0, 2026-10-05, sp00verify). The activation welcome ra...
A rename clears the phonetic spelling of the name it changed (SP94-F-1)
The AI's speech pairs the org's CURRENT name with whatever spelling is stored. The Getting-Started wizard renames through PUT /org/{id} without sending a spelli...
Assigning a computer reads the one member, not the whole organization
HostedComputerAccess.isMember loaded every member of the organization to test one id, and emailOf, called right after it on the same assign path, did the same t...
The AI-dispatch audit trail names people the same way chat does
**************** hand-duplicated MemberDisplayNames' pre-fix precedence (usernameAlias wins unconditionally over the real name), with its own comment warning th...
An address on either platform apex signs in to the account holding its twin
The owner signed in on login.kamouniverse.com with the brand's new address and was told "User does not exist". The account's address is Sage@KamoCRM.com. Since ...
A like is stamped, so it saves
media_obj_reports.date_created is NOT NULL, and the like was built without it: @ColumnDefault only shapes the DDL, so Hibernate wrote NULL and every like failed...
Edit, like and delete one post or note by its own id, never the whole stream
A feed, the organization's (the Clubhouse) or a lead's notes, is ONE POST session and every post or note is a message in it, so every item the feed lists carrie...
SPF advice recognises kamouniverse.com; the brand's aliases are reserved on both apexes
SPF: kamouniverse.com publishes the same record as spf.kamocrm.com (v=spf1 ip4:47.181.8.84 mx -all), so a customer who wrote include:kamouniverse.com has alread...
Platform fallbacks name the primary apex, not a kamocrm.com literal
Four places kept their own "kamocrm.com" literal as the platform host they fall back to, so they could never follow the brand to kamouniverse.com. Each now read...
One organization can no longer take another's <alias>.kamocrm.com routing
Any member of an organization with no root could add the root victim.kamocrm.com (POST /api/security/domains checked no right). Listing the domains then self-he...
A lead's notes stream, addressed by its guid, keeps the lead's own read rule
Every note on a lead now sends the lead stream's guid on /topic/media/feed/<orgId> (SP99-T3), which any member of the organization may subscribe to. The guid-ad...
A new commit log is translated at once, not behind the sweep's backlog
The first translation of a commit log and the sweep's retries shared one three-thread executor, first come first served. With the SP99 T6 repair's 326 commit lo...
The translation recount is the first statement of its own transaction
A locale save was an upsert and then a recount that reads the commit log's rows, in one transaction. Yugabyte restarts a read transparently only when it is the ...
One pod at a time translates a commit log, and a finished one is not redone
Both SecurityService pods run the translation sweep: its lock lasts only as long as the dispatch. Each took up the same 50 commit logs, and a pod's in-flight se...
A re-translation no longer deletes the translation it replaces
Since 1f715e4 (2026-09-23) saveLocaleTranslation loaded the locale's row to decide whether the count moved, bulk-deleted it and saved a new one. The load left t...
Close the AI identity edge cases the SP02 review left open
- A never-hired AI relabelled a person no longer keeps ai_state and the pause columns (master 6.1: NULL for a person). They are written only by SQL, so the ...
A lead you may not open takes no status change and no note
PUT /api/security/leads/{id} and POST /api/security/media/posts checked only the lead's organization, so a member without VIEW_UNASSIGNED_LEADS could change the...
CalDAV and CardDAV sign in with a username and password, through every sign-in gate
EmailService's DavAuthFilter posted Basic credentials to **************** a route that never existed (405), so since 2026-03-19 no phone (iOS, DAVx5) could add ...
Clear the session cookie on the bare apex, not ".apex"
Logout built the cookie domain as ".kamocrm.com". Tomcat's RFC 6265 cookie processor refuses a leading dot and throws, so logout answered 500 "Logout failed" af...
A platform apex can't be removed from the DNS page
The platform organization gained kamouniverse.com as a second root domain, and the DNS page then offered "Remove" on kamocrm.com. Deleting it took kamocrm.com a...
Two more root-domain picks follow OrgDomains.primaryDomain
BranchTypeController's parentRootDomain (the create-branch wizard's web-alias zone) and PortalAccountController's api.<root> (borrower-portal sign-in) each took...
Watch and Take over open their connection in the gateway's client
Guacamole 1.5.5's client reads the #/client/<id> fragment with atob (one character per byte) and btoa's every connection name it lists, so a name outside Latin-...
A loan Kamo creates now links, and a refused one says why on the lead
Ian's Create Loan reached Arive, was refused inside the Zap, and Kamo never knew: Zapier had already answered 200, and Arive fires no new_loan for a loan made t...
A hire-step owner answering 401 has not shipped yet, so the step waits
VOIPService and ComputeService answer any path they do not serve from their session layer with 401, so Ava's EXTENSION and WORKSTATION steps went FAILED before ...
An AI member never founds an organization
The second door to IMPORTANT-1 of the SP02 final review. POST /api/security/organizations needs no right for a standalone organization: any signed-in user may c...
Security-model writes require CONFIGURE_SYSTEM
Closes the SP02 final review's IMPORTANT-2. POST /api/security/models, PUT and DELETE /api/security/models/{id} and PUT /api/security/master-model only resolved...
An AI member is never an owner or a platform operator
Closes the door around the AI never-grantable floor that the SP02 final review found (IMPORTANT-1). Platform rights and the owner flag are not RoleRightTypes, s...
A verification resend that names its account goes to the account's own org
An organization with no domain has no register host of its own, so its members land on register.<platform apex>, whose host names the platform. The resend endpo...
A hot reassign's first note creates the lead's stream linked to the lead
The stream is created for the lead, as the lead view's feed creates it, so its MEDIA_SESSION_POST row carries LEAD_ID and POST_CREATED goes to media.feed.lead.<...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.