Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·49 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

39/49 done10 open3 open blockers

Selected taskclear

SECURITY — `private` does nothing: 13 of 14 public /content routes ignore visibility

DoneOwner · ait_606fb35cBlocker

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**SECURITY — `private` does nothing: 13 of 14 public /content routes ignore visibility** · done · blocker

Where it sits: TacTile › Inbox — on deck

## The brief on file

CLOSED IN PRODUCTION 2026-08-07 — PR #258 (13104bea), deployed to staging then prod, verified live on both api.tactile.to and whitelabel.tactile.to.

BEFORE (prod): GET /api/notes/0RCIFJVUP/content → 200 {branding, html_body, name}; GET /api/documents/0181KFNRZ/content → 200 {download_path, inline_url, …}. 137 private documents and 4 private notes readable by anyone holding the hash.
AFTER (prod): both → 404, on both hosts. Public unaffected — /api/form/15PL2M2UZ 200, tactile.to/t/15PL2M2UZ 200, /api/health 200. The private response body is byte-identical to a hash that was never issued ({"error":"Destination not found."}), so there is no existence oracle.

IMPLEMENTATION: one gate at the dispatcher (apps/api/tactile-api/src/middleware/visibility-gate.ts), wired beside applyPublicResolverLimit in index.ts because that middleware already owns exactly these paths via isPublicResolverPath and already carries the deny-by-default rule. Thirteen per-route checks would have been thirteen chances to forget and route fifteen would arrive unguarded.

FOUR THINGS THE FIX GETS RIGHT, each of which would have been a defect on its own:
1. Owner exception — the owner's editor and preview read these SAME public endpoints (apps/web DestinationPreview.tsx:73 → destinations-core getJson, which sends the Bearer on every GET for exactly this reason). Without it the leak would have been closed by breaking every owner's ability to preview or edit their own private destination.
2. 404, never 403 — a 403 confirms the hash exists and hands an enumerator a free oracle.
3. Trigger-hash resolution — the gate resolves trigger→destination the same way the routes do, or a private destination reached through its trigger would sail past a gate that found nothing to check.
4. Fails CLOSED on lookup error.

Tests drive the gate rather than reading it (tests/unit/visibility-gate.test.ts, 10 tests), mutation-checked: allowing private fails 2, failing open fails 1, using 403 fails 3, unwiring from the pipeline fails 2.

STILL OPEN, related: contact / wifi / bluetooth / payment have no private rows in production today, so they were not leaking — but they are covered by the same gate now. Nothing further needed.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

SECURITY — `private` does nothing: 13 of 14 public /content routes ignore visibility