Problem: GET .../errors, /errors/{id}, /errors/groups, status updates are all unauthenticated (audit: src/router.ts:181-190).
Scope: gate them behind the auth/membership middleware.
Done when: only project members can read/triage that project's errors.
Closed by the global membership guard (#54) + regression tests in 8049a2d.
Every error read endpoint — /api/sites/{siteId}/errors, /statuses, /timeseries, /comparison, /groups, /detail, /{errorId}, /alerts, plus the stealth /api/p/{siteId}/issues* aliases — matches siteAuthGuard's guarded prefix, so with ANALYTICS_REQUIRE_AUTH=true they 401 without a session and 403 without project membership (viewer for reads, editor for status/assign writes). The test pins all 14 routes so a future route shuffle can't silently unguard them.
Sign in to comment on this issue.