fix(security): C18 URL hijacking + C20 unauthenticated workspace deletion - #35

Merged

HongmingWang-Rabbit merged 2 commits into

mainfrom

fix/c18-c20-workspace-auth

Apr 14, 2026

Commits on Apr 14, 2026

fix(security): C18 register ownership check, C20 DELETE auth gate

Dev Lead Agent
and
claude
committed
07bb730
fix(gate-1): pass bearer token on DELETE /workspaces in E2E smoke test

Hongming Wang
and
claude
committed
b96d414