Matti Nannt 05d7d1165a fix: strip client-provided timestamps in client response API (ENG-828) ...

The client-facing POST /api/v1/client and /api/v2/client response
endpoints accepted arbitrary createdAt/updatedAt values, allowing any
respondent to backdate or future-date their submission and poison
time-series analytics.

Strip both fields before the Prisma insert in the client code paths.
The management API retains the ability to pass timestamps, as it is
authenticated and used for legitimate server-side data imports.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-19 09:32:06 +02:00

..

storybook

chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates (#7977)

2026-05-12 06:44:08 +00:00

web

fix: strip client-provided timestamps in client response API (ENG-828)

2026-05-19 09:32:06 +02:00