Scope: validate the project key/DSN on every error ingest (handleValidateApiKey('error-tracking')) and resolve siteId from the key, not the body. Rate-limit + reject missing/invalid keys with 401.
Done when: ingest is keyed end-to-end and an attacker can't inject errors into a project without its key.
Verified done: POST /errors/collect validates the project DSN/ingest key (handleValidateApiKey 'error-tracking') and resolves siteId from the key. Confirmed live — an unkeyed POST returns 401, a POST with the embedded ingest key returns 204. The SDK now uses it (#67).
Sign in to comment on this issue.