Tenant settings are isolated

Tenant settings frequently contain sensitive configuration: API keys, webhook secrets, custom domain names, and feature flag states. CWE-639 and OWASP A01 apply when settings are accessible by record ID without an organizationId check — an attacker who knows or can enumerate a settings UUID retrieves another tenant's configuration. For settings that contain integration credentials, this constitutes a direct credential disclosure event.

Always include the tenant scope in both fetch and update operations for settings records:

// Fetch — always scope to current org, never by bare ID
const settings = await db.organizationSettings.findFirst({
  where: { organizationId: session.user.organizationId }
})

// Update — use updateMany with tenant scope so a mismatch returns count: 0
const updated = await db.organizationSettings.updateMany({
  where: { id: params.id, organizationId: session.user.organizationId },
  data: { ...payload }
})
if (updated.count === 0) return new Response('Not found', { status: 404 })

In src/app/api/settings/[id]/route.ts, remove any findUnique({ where: { id } }) pattern that does not include organizationId in the predicate. Settings cache keys must also include the tenant identifier (see cache-keys-include-tenant).