Repository: migration-planner  
Priority: High  
Location: internal/handlers/v1alpha1/source.go:74

Description:  
DELETE /api/v1/sources route is wired in openapi.yaml and calls sourceSrv.DeleteSources(ctx) with no filter. The service method runs Unscoped().Exec("DELETE FROM sources") against shared Postgres. No admin gate, no org scoping, no confirmation required.

Security Impact:  

Any authenticated user can destroy all customers' sources, agents, and assessments

Single curl command causes total data loss across entire SaaS

Critical availability and integrity catastrophe

Fix Suggestion:  
Immediate: Hard-disable the handler (return 401 with explanatory message). Long-term: Either drop the route from openapi.yaml and delete SourceStore.DeleteAll, or re-implement as org-scoped bulk delete behind explicit edit permission. See patches/f004.patch.