Manish Gupta 4b52dce76e [WEB-7855] fix(security): prevent project invite email disclosure via unauthenticated GET (#9305) ...

ProjectJoinEndpoint.get() was AllowAny and used ProjectMemberInviteSerializer
(fields = "__all__"), leaking the invitee's email and token to anyone who
knew the workspace slug, project ID, and invite UUID (GHSA-2r58-hgv7-635q).

Introduce ProjectMemberInvitePublicSerializer with an explicit safe field list
that excludes `email` and `token`, and swap it in for the public GET endpoint.
The full serializer is retained for authenticated admin viewsets.

Co-authored-by: Plane AI <noreply@plane.so>

2026-07-01 17:34:45 +05:30

..

admin

…

api

[WEB-7855] fix(security): prevent project invite email disclosure via unauthenticated GET (#9305)

2026-07-01 17:34:45 +05:30

live

…

proxy

…

space

…

web

[GIT-239 | GIT-240] refactor: hooks and constants consolidation to core (#9204)

2026-06-26 20:36:52 +05:30