Flagged by the vendor-visibility-rbac route audit (docs/security/vendor-visibility-rbac.md, PR #377). AanbodController::getAanbod() relies on implicit-null auth handling rather than the explicit getUser()===null guard applied to GebruikController in REQ-004. Out of scope for #377's declared Impact; apply the same explicit guard pattern here.
Flagged by the vendor-visibility-rbac route audit (docs/security/vendor-visibility-rbac.md, PR #377). AanbodController::getAanbod() relies on implicit-null auth handling rather than the explicit getUser()===null guard applied to GebruikController in REQ-004. Out of scope for #377's declared Impact; apply the same explicit guard pattern here.