build1 distinct publisher
A second ApiResource block left CoopCycle's address-book read outside the tenant check
API Platform checks authorization per operation, so the guard on the POST told a reviewer nothing about the GET declared on a different entity, and the provider behind that GET trusted the store id in the path.
Publishers:dev.to
Reality
- Evidence60
- Adoption25
- Hype gap+12
- Incentives55