Severity
High — cross-org nonsense diffs can become import jobs.
What happens
compareWithLive runs props.sf.runQuery(schedule.soql, props.tabId) — routed through the active Salesforce tab's session. The schedule/snapshot has an explicit orgId, but it is never checked. A snapshot captured from production, compared while the user's tab is a sandbox, silently produces a bogus diff (everything added/changed), and "Create reviewed Import" then builds an import dataset from it.
Evidence
src/ui/screens/SnapshotCenterScreen.tsx:73-92src/ui/api/sf.ts:57 (tab routing)
Suggested fix
Query via sf.crossOrgQuery(schedule.orgId, schedule.soql) (already exists, used by DataComparisonScreen), or refuse when tab org ≠ snapshot.orgId.
Environment
Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).
Severity
High — cross-org nonsense diffs can become import jobs.
What happens
compareWithLiverunsprops.sf.runQuery(schedule.soql, props.tabId)— routed through the active Salesforce tab's session. The schedule/snapshot has an explicitorgId, but it is never checked. A snapshot captured from production, compared while the user's tab is a sandbox, silently produces a bogus diff (everything added/changed), and "Create reviewed Import" then builds an import dataset from it.Evidence
src/ui/screens/SnapshotCenterScreen.tsx:73-92src/ui/api/sf.ts:57(tab routing)Suggested fix
Query via
sf.crossOrgQuery(schedule.orgId, schedule.soql)(already exists, used by DataComparisonScreen), or refuse when tab org ≠snapshot.orgId.Environment
Commit
74cf21b(main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).