Update app.js

app.js

@@ -305,13 +305,17 @@ app.post('/new/project', validateRequest, async (req, res) => {
 });
 
 app.post('/project/feedback', async (req, res) => {
-    const { projectId, prompt, hierarchyContext, scriptContext, logContext, taskComplete, images } = req.body;
+    const { userId, projectId, prompt, hierarchyContext, scriptContext, logContext, taskComplete, images } = req.body;
     
     // This now handles Hydration automatically
     const project = await StateManager.getProject(projectId);
     
     if (!project) return res.status(404).json({ error: "Project not found." });
    
+  if (project.userId !== userId) {
+        console.warn(`[Security] Unauthorized ping for ${projectId}. Owner: ${project.userId}, Request: ${userId}`);
+        return res.status(403).json({ error: "Unauthorized: You do not own this project." });
+   }
    await db.ref(`projects/${projectId}/info/status`).set("working");
       
     if (taskComplete) {