Upload-scoped API key can retarget app_versions.r2_path and trigger deletion of another R2 bundle object

Summary

An upload-scoped API key can directly modify public.app_versions.r2_path through Supabase PostgREST, then soft-delete that version to make Capgo's on_version_update cleanup trigger delete the attacker-controlled r2_path.

I confirmed in production that an upload-capable key can:

1. create or control one app_versions row,
2. PATCH that row's r2_path to point at another live bundle object,
3. soft-delete the controlled version so cleanup deletes the retargeted R2 object.

Impact

Upload-scoped API keys can destroy or disrupt other apps' live OTA bundles by retargeting r2_path and triggering delete cleanup.

CWE-862. Reported by @Judel777.

Fix

This was fixed by intentional security PR #3104 (fix(security): reject foreign r2_path retarget on version delete), merged 2026-08-17.

Adds guard_app_version_r2_path so r2_path must be null or the canonical orgs/{owner_org}/apps/{app_id}/{name}.zip, and skips trash of non-canonical paths. Advisory package metadata lists patched_versions 12.128.2.

Maintainer note (2026-08-24): the original long-form description was accidentally overwritten during triage API testing. Restored from retained excerpts + the merged fix PR. Contact Capgo if you need the full original reporter writeup recovered from backups.