Onlook Design Updates: Weekly Recap - Closing a Cross-Account Security Gap
This week's work centered on one significant security fix: a sweeping authorization overhaul across the tRPC backend that closes an IDOR vulnerability, replacing scattered, partial checks with a consistent project-membership verification pattern. One pull request, backed by one supporting commit, touched nearly every project-scoped router in the codebase.
Duration: PT3M9S
Episode overview
This episode is a short developer briefing from Onlook Design Updates.
It explains recent repository work in plain language.
- Show: Onlook Design Updates
- Published: 2026-07-27T16:08:34Z
- Audio duration: PT3M9S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day, and welcome to Onlook Design Updates. This recap covers July 20th through July 27th, 2026.
This week: one pull request activity item, and one additional commit. Small in count, but this was a security-critical week.
The lead story is PR 3129, merged by Mariano Rebord, which closes out issue 3122 and supersedes an earlier partial fix in PR 3127. Here's the core issue: Onlook's database client connects with elevated privileges that bypass row-level security, which means authorization has to be enforced explicitly in application…
The fix is a full audit of the tRPC surface, applying one consistent resolve-then-verify pattern everywhere. New helpers now cover conversations, messages, suggestions, branches, canvases, frames, invitations, sandboxes, deployments, and domain verification. Every one of these checks returns the same merged…
A few design details are worth noting for developers working in this codebase. Sandbox access checks intentionally allow a sandbox that isn't yet linked to a project — that keeps flows like blank-project creation, forking, templates, and local imports working before a formal project link exists. Authorization…
The routers affected span project,…