FM-001 — Cross-Organization Cache Pollution

Field	Value
Severity	SEV-1 (cross-tenant data exposure)
Category	Multi-Tenancy Data Leaks
Status	🟢 Archived (resolved, guards in place)

Blameless rule applies. This document is about systems.

Symptom

Users see data from another organization after switching workspaces.

Root cause

React Query cache key did not include organizationId. Cache from org A persisted when viewing org B.

Fix

Always include currentOrganization?.id in query keys. Add enabled: !!currentOrganization?.id to prevent fetches during org switch.

// ❌ BUG PATTERN
queryKey: ['/api/contacts']

// ✅ FIX
queryKey: ['/api/contacts', currentOrganization?.id]

Prevention / Guard

• The pattern-registry.mdc React Query Pattern enforces this. Code review must verify org ID in all query keys.
• Query key convention documented in CLAUDE.md rule 5.

Related

• Engineering → Incidents
• ADR-0002 — Repository Pattern — broader org-scoping enforcement
• Data Access standard
• FM-002 — Org ID from Request Body — same class
• FM-012 — || 1 Fallback Leaks Org 1 Data — same class
• FM-047 — Diagnostic Route Exposes Task Data — same class