The attack-case tests from the AWS migration checked the obvious things: reading another book, replaying an old revision. A review on 2026-09-27 found something they did not cover.
What happened
A reviewer, reading one of the newer handlers, noticed that a request could name a target that did not have to belong to the signed-in user. The handler trusted the identity for authentication but did not re-check it for authorisation on that specific path. A signed-in user could, with a crafted request, write where they should not.
No evidence was found that anyone had used it.
The fix
The handler now derives the target from the session rather than from the request, which is the pattern every other handler already followed. A regression test sends the crafted request and expects a refusal. The attack-case suite was then extended to try the same trick against every write handler, so a future handler cannot repeat the mistake quietly.
Why this entry exists
It would be easy to leave this out of a public history. It stays in because the fix and the test are the point: the suite is now 39 suites and roughly four thousand assertions, and this is one of the reasons.