Cursor Agent c8c6d9e042 fix(db): require run owner for all secret and approval answers
answerRunInput already blocked cross-member answers for credential
secret asks and always-allow approvals, but one-time allow/deny and
generic OTP secret asks had no run.userId check. Align the DB gate so
shared-space prompt answers cannot be hijacked at the persistence layer.

Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
2026-09-22 07:04:47 +00:00
..