Any authenticated user could insert, update or remove an Organization or Team document over Meteor/DDP when its _id equalled their user id. The collection allow rules treated document identity as authority without requiring site-admin, tenant-admin or membership privileges, exposing tenant configuration and deletion. All six operations now share one site-admin-only decision; legitimate scoped and internal writes continue through their authorization-enforcing server methods. Refused authenticated attempts are rate-limited, attributed and shown in Admin Panel / Problems. See GHSA-p4cq-83j9-7g73 and TenantBleed.

An authenticated Only Assigned Comment member could modify any card through the REST API, even when not assigned to it. The shared REST authorization helper duplicated a list of excluded role flags and omitted isCommentAssignedOnly, so every card mutation route using it accepted a role whose canonical policy says write: false. The helper and both parallel attachment APIs now use the shared role-capability decision. All non-writing roles are denied, while No Comments and the other legitimate writing roles retain access. Refused attempts are rate-limited, attributed and shown in Admin Panel / Problems. See GHSA-f396-42fx-vr88 and AssignedBleed.

An authenticated Comment Only member could call importIcsToBoard over Meteor/DDP and create arbitrary cards. The method checked board membership and excluded only read-only roles, so Comment Only, Only Assigned Comment and Worker members reached card insertion despite the role policy denying them write access. The DDP path now uses the same canonical write-capability helper as its REST sibling. Regression coverage denies all five non-writing roles and confirms that the four legitimate writing roles retain access. Refused attempts are rate-limited, attributed and shown in Admin Panel / Problems. See GHSA-fpm6-r5fg-2mrg and CalendarBleed.

The removed Activities eye left its old per-card showActivities: false value in control, so opening the new caret could still request comments only. Opening the section now always requests its complete history. The comments REST endpoint also validates the card against the requested board before selecting all records by their authoritative cardId, so older and imported comments with missing or stale denormalized board metadata are no longer omitted without weakening board isolation. Positive and negative regression tests cover both retrieval paths.

The destination picker treated a list without a swimlaneId as shared only by the default swimlane. It now combines board-global lists with the selected swimlane’s own lists for every swimlane, while continuing to exclude lists owned by another swimlane. Regression tests cover both cases and the shared picker used by Move Card and Copy Card.

The Release All log showed no riscv64 compiler or recipe failure: Launchpad kept it pending until GitHub cancelled the runner at its six-hour limit. The workflow now gives its local waiter five hours, then leaves the named Launchpad build running and ends cleanly. Its flattened source commit has deterministic dates, so a later job re-run reconnects to that same build instead of adding another one to the queue. Store and GitHub Release publishing remain gated on a downloaded, architecture-checked squashfs snap. Regression tests cover the stable snapshot identity, the pending hand-off and the no-artifact publishing guard.