GHSA-3xx2-mqjm-hg9x

## Summary The `GET`, `POST`, and `DELETE` handlers under `/agents/:id/keys` in the Paperclip control-plane API only call `assertBoard(req)`, which verifies that the caller has a board-type session but does not verify that the caller has access to the company owning the target agent. A board user whose membership is limited to Company A can therefore list, create, or revoke agent API keys for any agent in Company B by supplying the victim agent's UUID in the URL path. The `POST` handler returns the newly-minted token in cleartext, which authenticates subsequent requests as `{type:"agent", companyId:<CompanyB>}`, giving the attacker full agent-level access inside the victim tenant — a complete cross-tenant compromise. ## Details The three vulnerable routes are defined in `server/src/routes/agents.ts:2050-2087`: ```ts router.get("/agents/:id/keys", async (req, res) => { assertBoard(req); // <-- only checks actor.type === "board" const id = req.params.id as string; const keys = await svc.listKeys(id); res.json(keys); }); router.post("/agents/:id/keys", validate(createAgentKeySchema), async (req, res) => { assertBoard(req); // <-- same const id = req.params.id as string; const key = await svc.createApiKey(id, req.body.name); // ... activity log ... res.status(201).json(key); // returns cleartext `token` }); router.delete("/agents/:id/keys/:keyId", async (req, res) => { assertBoard(req); // <-- same const keyId = req.params.keyId as string; const revoked = await svc.revokeKey(keyId); if (!revoked) { res.status(404).json({ error: "Key not found" }); return; } res.json({ ok: true }); }); ``` `assertBoard` in `server/src/routes/authz.ts:4-8` is intentionally narrow: ```ts export function assertBoard(req: Request) { if (req.actor.type !== "board") { throw forbidden("Board access required"); } } ``` It does **not** consult `req.actor.companyIds` or `req.