Phase 1: Critical security fixes - 59 permissions, grants, RLS, mass-assignment, ownership, leaks, MIME

app/schemas/attachment.py

@@ -10,7 +10,6 @@ class AttachmentResponse(BaseModel):
     entity_type: str
     entity_id: str
     filename: str
-    file_path: str
     mime_type: str
     file_size: int
     uploaded_by: str | None = None

app/schemas/system_settings.py

@@ -41,6 +41,11 @@ class SystemSettingsResponse(BaseModel):
     company_legal_form: str | None = None
     company_street: str = ""
     company_city: str = ""
+    # Sensitive fields — masked in API response, only visible to system admin
+    tax_number: str | None = None
+    vat_id: str | None = None
+    iban: str | None = None
+    bic: str | None = None
     company_zip: str = ""
     company_country: str = ""
     tax_number: str | None = None