What: Jetstream Teams are fully enabled — users can create teams, invite members by email, switch "current team," and manage team roles, all exposed in the nav — but no application data is actually scoped by team anywhere.
Where:
config/jetstream.php:64 — Features::teams(['invitations' => true])resources/js/Layouts/AppLayout.vue:91,95,260,264 — team switcher/management UI in the navresources/js/Pages/Teams/** — full Teams CRUD/invitation UIapp/Http/Controllers/DashboardController.php, EndpointController.php, EventController.php (web and API) — all scope strictly by $model->user_id !== $request->user()->id, never by teamEndpoint, Event, Delivery models — no team_id column or relation at all
Why it matters: Inviting a "team member" gives that user zero access to the inviter's endpoints, events, or deliveries — the feature is pure UI/DB dead weight that actively misleads users into believing they can collaborate on or share webhook configs with teammates. It also adds real, unused attack surface (invitation-by-email flows, team CRUD, member-role management) that protects nothing of value, and isn't mentioned anywhere in CLAUDE.md's architecture description of the product as single-owner-per-resource.
Suggested fix: Either wire team_id into Endpoint/Event ownership and scope controllers accordingly so Teams actually share webhook configuration, or disable the Teams feature (Features::teams()) and remove its UI entirely, since the product is currently designed as single-user-owns-resource.
What: Jetstream Teams are fully enabled — users can create teams, invite members by email, switch "current team," and manage team roles, all exposed in the nav — but no application data is actually scoped by team anywhere.
Where:
config/jetstream.php:64—Features::teams(['invitations' => true])resources/js/Layouts/AppLayout.vue:91,95,260,264— team switcher/management UI in the navresources/js/Pages/Teams/**— full Teams CRUD/invitation UIapp/Http/Controllers/DashboardController.php,EndpointController.php,EventController.php(web and API) — all scope strictly by$model->user_id !== $request->user()->id, never by teamEndpoint,Event,Deliverymodels — noteam_idcolumn or relation at allWhy it matters: Inviting a "team member" gives that user zero access to the inviter's endpoints, events, or deliveries — the feature is pure UI/DB dead weight that actively misleads users into believing they can collaborate on or share webhook configs with teammates. It also adds real, unused attack surface (invitation-by-email flows, team CRUD, member-role management) that protects nothing of value, and isn't mentioned anywhere in CLAUDE.md's architecture description of the product as single-owner-per-resource.
Suggested fix: Either wire
team_idintoEndpoint/Eventownership and scope controllers accordingly so Teams actually share webhook configuration, or disable the Teams feature (Features::teams()) and remove its UI entirely, since the product is currently designed as single-user-owns-resource.