Tenant data export is scoped to the requesting tenant

Data export endpoints that query broadly and filter in application memory load every tenant's records into a single server process — a cross-tenant data commingling event that violates CWE-285 and OWASP A01. For GDPR Art. 20 (Data Portability) compliance, the exported data must be scoped to the requesting tenant's own records. Beyond compliance, an export endpoint that generates a file for Tenant A and returns a download link that Tenant B can also use constitutes a direct data breach with a durable artifact.

Always scope export queries at the database level and validate tenant ownership on download of async-generated export files:

// Scope the query — never filter in application memory
const data = await db.project.findMany({
  where: { organizationId: session.user.organizationId },
  include: { documents: true, members: true }
})

// For async exports, tie the job to the org and validate on download
const exportJob = await db.exportJob.create({
  data: { organizationId: session.user.organizationId, status: 'pending' }
})

// Download handler — verify ownership before serving the file
const job = await db.exportJob.findFirst({
  where: { id: params.jobId, organizationId: session.user.organizationId }
})
if (!job) return new Response('Not found', { status: 404 })

Place export logic in src/app/api/export/route.ts and audit it separately from general data routes — export endpoints are high-value targets because they return bulk data in a single response.