diff --git a/apps/api/plane/space/views/asset.py b/apps/api/plane/space/views/asset.py
index b9b2593187..0389a658c0 100644
--- a/apps/api/plane/space/views/asset.py
+++ b/apps/api/plane/space/views/asset.py
@@ -150,9 +150,8 @@ class EntityAssetEndpoint(BaseAPIView):
         if not deploy_board:
             return Response({"error": "Project is not published"}, status=status.HTTP_404_NOT_FOUND)
 
-        # Scope to the caller's own asset: public-site users may only mutate assets
-        # they created (post() sets created_by=request.user). Without created_by,
-        # any authenticated user could touch another user's asset (GHSA-5q33-2766-fprm).
+        # Public-site users may only mutate assets they created; without this any
+        # authenticated user could touch another's.
         asset = FileAsset.objects.filter(
             id=pk,
             workspace=deploy_board.workspace,
@@ -179,8 +178,7 @@ class EntityAssetEndpoint(BaseAPIView):
         # Check if the project is published
         if not deploy_board:
             return Response({"error": "Project is not published"}, status=status.HTTP_404_NOT_FOUND)
-        # Scope to the caller's own asset (GHSA-5q33-2766-fprm) — a public-site user
-        # may only delete assets they created, not another user's.
+        # A public-site user may only delete assets they created.
         asset = FileAsset.objects.filter(
             id=pk,
             workspace=deploy_board.workspace,
@@ -207,8 +205,7 @@ class AssetRestoreEndpoint(BaseAPIView):
         if not deploy_board:
             return Response({"error": "Project is not published"}, status=status.HTTP_404_NOT_FOUND)
 
-        # Scope to the caller's own asset (GHSA-5q33-2766-fprm) — a public-site user
-        # may only restore assets they created, not another user's.
+        # A public-site user may only restore assets they created.
         asset = FileAsset.all_objects.filter(
             id=pk,
             workspace=deploy_board.workspace,
@@ -239,8 +236,7 @@ class EntityBulkAssetEndpoint(BaseAPIView):
         if not asset_ids:
             return Response({"error": "No asset ids provided."}, status=status.HTTP_400_BAD_REQUEST)
 
-        # Scope to the caller's own assets (GHSA-5q33-2766-fprm) — a public-site user
-        # may only rebind assets they created, not another user's.
+        # A public-site user may only rebind assets they created.
         assets = FileAsset.objects.filter(
             id__in=asset_ids,
             workspace=deploy_board.workspace,
diff --git a/apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py b/apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py
index 263577f61e..570b384168 100644
--- a/apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py
+++ b/apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py
@@ -4,7 +4,7 @@
 
 """Contract tests for public Space asset mutation ownership scoping.
 
-Regression coverage for GHSA-5q33-2766-fprm. The public Space asset
+The public Space asset
 delete/restore/bulk (and patch) endpoints require only authentication and scoped
 assets to the deploy board's workspace/project — but not to
 ``created_by=request.user``. Any authenticated public-site user who knew the