added instruction.md

2026-10-08 15:35:47 -04:00
parent 6e75d0d3d5
commit 4a43df9a41
1 changed files with 1 additions and 1 deletions
--- a/worker-toolkit-potion-polyglot/harbor-tasks/potion-voice-user-ownership/instruction.md
+++ b/worker-toolkit-potion-polyglot/harbor-tasks/potion-voice-user-ownership/instruction.md
@@ -1 +1 @@
-# Replace this with your task prompt
+Its possible our background workers (voice-synthsizer-job-handler and voice-cloning-job-handler) do not enforce strict tenant isolation when loading and updating MongoDB records. Specifically, job handlers fetch database models using only document IDs supplied in SQS payloads without verifying that they belong to the job's userId. Audit all db queries across both worker handlers and make them enforce strict multi-tenant authorization so users cannot access or modify records belonging to other tenants.
		`@@ -1 +1 @@`
			`# Replace this with your task prompt`				Its possible our background workers (voice-synthsizer-job-handler and voice-cloning-job-handler) do not enforce strict tenant isolation when loading and updating MongoDB records. Specifically, job handlers fetch database models using only document IDs supplied in SQS payloads without verifying that they belong to the job's userId. Audit all db queries across both worker handlers and make them enforce strict multi-tenant authorization so users cannot access or modify records belonging to other tenants.