Returning 403 Forbidden leaks the existence of tickets to users who should not know about them. Use 404 Not Found consistently across all access-controlled endpoints to prevent enumeration. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Returning 403 Forbidden leaks the existence of tickets to users who should not know about them. Use 404 Not Found consistently across all access-controlled endpoints to prevent enumeration. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>