Curly Braces Around a Table Name Skipped Trigger.dev's Tenant Filter
Trigger.dev runs background jobs and AI agents for more than 30,000 developers. Its query API adds an organization filter to each table, but a table name in {braces} skipped it, so any API key could read the rows of all tenants. The fix shipped in 4.7.3, one day after my report.