backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts
The unconditional permission check should be removed here (lines 261-264) to match the behavior implemented in secret-sync-service.ts:95-98 where the unconditional check was removed. According to the PR description, the behavior change is: "We no longer require unconditional Read at list time. We load all syncs for the project and filter each one with the permission subject that includes environment, secretPath, and connectionId." This service still requires unconditional Read permission before filtering by connectionId, which defeats the purpose of conditional permissions.

    const secretRotations = await secretRotationV2DAL.find({

backend/src/services/secret-sync/secret-sync-service.ts
Removing the unconditional permission check enables proper conditional permission filtering by connectionId. However, this creates a potential security issue: a user with NO permissions at all on secret-syncs can bypass this check (line 95-98) and proceed to load ALL syncs from the database (line 100-103), then filter them (line 108-119). If the user has zero permissions, they should be denied immediately without loading any data. Consider adding a check to verify the user has at least SOME permission on secret-syncs (conditional or unconditional) before proceeding.

Example attack: A user with zero secret-syncs permissions could still trigger database queries to load all syncs, potentially causing performance issues or revealing timing information about the number of syncs in the project.

backend/src/services/secret-sync/secret-sync-service.ts
Critical Security Issue: Permission bypass when updating connectionId

The permission checks use the OLD connectionId from the existing sync, but when params.connectionId is provided (line 502-511), the update allows changing to a NEW connection without verifying permission against that new connectionId.

Attack scenario:

1. User has Read/Edit on syncs with connectionId=conn-1
2. User does NOT have access to connectionId=conn-2
3. User calls update with params.connectionId=conn-2
4. Permission check at line 436-443 passes (checks OLD conn-1)
5. Line 502-511 only validates the connection exists
6. User successfully updates sync to use conn-2, bypassing permission restrictions

Fix required:
When params.connectionId is provided, add a permission check against the NEW connection:

if (params.connectionId && params.connectionId !== connectionId) {
  // Check permission against NEW connectionId
  ForbiddenError.from(permission).throwUnlessCan(
    ProjectPermissionSecretSyncActions.Edit,
    secretSync.environment?.slug && secretSync.folder?.path
      ? subject(ProjectPermissionSub.SecretSyncs, {
          environment: secretSync.environment.slug,
          secretPath: secretSync.folder.path,
          connectionId: params.connectionId
        })
      : ProjectPermissionSub.SecretSyncs
  );
}

Note: Secret rotation correctly prevents this by excluding connectionId from TUpdateSecretRotationV2DTO.