GHSA-84c9-qqpq-2pq5

### Impact Tool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured vault** by passing `input.vault`, defeating multi-tenant isolation across ~90 tool sites. (`resources/read` was the only surface that already guarded this.) ### Patches Fixed in **1.3.1** (the fix was developed on the `v1.3.0` tag, which never published to npm; 1.3.1 is the first published release with the fix). Upgrade to `>= 1.3.1`. ### Workarounds Run a single vault per server process, or isolate each tenant on a separate process/credential. ### Fix A central `input.vault === ctx.vaultId` guard was added in dispatch before the scope check.