Always scope queries by organization_id/project_id — never trust user-supplied IDs alone

Directive (Burak Yigit Kaya, 2026-07-30): when querying resources, ALWAYS include organization_id and/or project_id in filters alongside the user-supplied ID. Correct pattern: Resource.objects.get(id=request.data["resource_id"], organization_id=organization.id). Never trust the supplied ID alone — IDOR is the threat model this rule addresses. Reinforced 2026-07-30 via PR #1318: project scoping moved from query=project:<slug> <user-query> (naive concatenation in search syntax — produces malformed queries, returns 400) to a separate project: [id] parameter (numeric project ID, isolated from user query). Use the NUMERIC project ID (projects[0].id from /api/0/projects/{org}/{slug}/), not the slug — slugs are only valid in query= search syntax, not as separate filter params. This is a hard rule; reviewers should reject any query that doesn't scope by org/project.