Phase 1: Critical security fixes - 59 permissions, grants, RLS, mass-assignment, ownership, leaks, MIME

2026-08-03 22:32:03 +02:00
parent bd9fc15418
commit 4f970a11eb
9 changed files with 302 additions and 3 deletions
@@ -41,6 +41,11 @@ class SystemSettingsResponse(BaseModel):
    company_legal_form: str | None = None
    company_street: str = ""
    company_city: str = ""
+    # Sensitive fields — masked in API response, only visible to system admin
+    tax_number: str | None = None
+    vat_id: str | None = None
+    iban: str | None = None
+    bic: str | None = None
    company_zip: str = ""
    company_country: str = ""
    tax_number: str | None = None