A signed-in user in one organization received a 403 for another organization’s invoice, but the response time and error body differ from a non-existent ID, which reveals whether an invoice exists.
Request
GET /api/v2/invoices/inv_8f21c0 Host: staging.acme.dev Authorization: Bearer ‹user B, org 2›
Response
HTTP/1.1 403 Forbidden
{"error":"invoice belongs to another org"}
(non-existent ID → 404 "not found")How to fix
Return the same 404 for “not yours” and “doesn’t exist”, and scope the lookup by organization in the query rather than checking ownership afterwards.