#harvester-access

Harvester API route exposed without security filter

Harvesters configure API routes and security filters independently, and mismatches between these definitions can leave endpoints publicly reachable. When a route lacks the expected authentication middleware, any client can invoke harvester operations, potentially retrieving or indexing sensitive records. This condition arises from the component's default all