openchat openchat osschat

Chat typing endpoints now enforce ownership

Security API Backend

This release tightens access to chat typing status so only chat owners can read or update it. This helps keep presence information private and prevents misuse across chats.

Security

Typing status endpoints now require chat ownership verification before returning or accepting typing updates. If you do not own the chat, the request is denied with a 403 Forbidden response.

This change helps prevent presence spoofing in other users' chats and reduces the risk of information disclosure through chat ID guessing or enumeration.