• Patched XSS, cross-org IDOR, and RCE vulnerabilities
• Timing-safe secret comparison across all auth paths
• Resolved 22 Dependabot alerts via dependency upgrades and pnpm overrides
• Migrated entire API from console logging to structured JSON logging
• Canonical log lines per authenticated request for debugging and analytics
• PostHog error tracking on API and Stripe webhooks
• Cross-org IDOR prevention: all queries scoped by organizationId from auth context
• Guardrail system with Biome GritQL plugins and architecture tests

Security & Observability