Security

Data Isolation

Multi-tenancy rules.

1 min read v1 API

Tenant models use company_id. Callers must scope queries — HasCompanyScope does NOT exist. Transaction model uses BelongsToCompany but transactions table has no company_id; filtering uses scopeForCompany via relations.

Known contradiction
Known contradiction Always verify company filtering in new queries—do not assume automatic scoping.