Candidate evidence
Inspect data export
The source includes private note bodies and credentials. No consent to share it exists. Contents are omitted in this fixture.
Inspect observation
In an isolated fixture, member B requests workspace A's export and receives its private rows. Expected: access is denied. Owner A's request succeeds.
Inspect historical document
Diagram from before workspace membership replaced a single-owner model. Its current applicability is unverified.
Inspect code excerpt
exportNotes.ts checks that an account is signed in, then reads rows by workspace ID. The excerpt does not show a membership or ownership check; trace the current caller and policy.
Inspect test excerpt
The export encoder has tests for commas, quotes and newlines. Preserve these behaviors when correcting access checks.
Inspect dashboard excerpt
Monthly signups and page views. No request, ownership or export implementation evidence.
Selections and writing stay in this browser tab until you request review. Up to five distinct revisions are saved per case.
Export your learning packet
Export requires a reviewed selection with the essential evidence and no unsuitable items. This is a fixture check, not a general security scan.