8d2c398

Security audit fixes: (1) CRITICAL: getVisibleUserIds returns [-1] sentinel for unresolvable non-root actors instead of [] which disabled the visibility filter; (2) HIGH: cacheUserId prefers public_id over id to prevent cache key collisions; (3) HIGH: strip cost_rate/bill_rate from earnings and taskSummary for non-root users in both WorklogController and McpController

2026-07-13T14:37:01+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>