Joseph Doherty
3427370831
-003 is a documented Won't Fix: the mitigating control is the ConfigEditor page policy on the only two surfaces that reach a browse session (/raw and /uns), there is no HTTP endpoint for browse, and PageAuthorizationGuardTests pins both pages to that exact policy. Recorded in docs/security.md under Control-Plane Authorization and pointed at from SqlDriverBrowser's class summary.