v1.3.10Website
•1 min read

Server-Side RBAC Enforcement on Key Mutations

Enforced server-side permission checks across all API key mutation endpoints to ensure read-only viewers cannot create, modify, or delete secrets.

#What's Changed

  • [Security] Added server-side role validation in POST /api/keys, PUT /api/keys/[id], DELETE /api/keys/[id], and POST /api/keys/bulk to reject mutation attempts from viewer-role members with 403 Forbidden.
  • [Security] Added role enforcement in MCP server key write routes (POST and PUT /api/mcp/v1/keys) to ensure AI agent tokens cannot bypass workspace permission boundaries.