CROSS_TENANT_DENIED

What triggered it

VibeCord is multi-tenant: every project, deploy, session, and credential has exactly one owner. When you try to access a resource and the request’s authenticated userId doesn’t match the resource’s ownerUserId, we deny with CROSS_TENANT_DENIED and audit-log the attempt.

Common ways to trigger it:

• You signed in with the wrong Discord account. Multiple Discord accounts -> easy mistake.
• A teammate sent you their dashboard URL. Direct URLs are owner-only — you’d need a share link.
• You tried to open a project after the original owner deleted you from a workspace.
• A redirect or deep link points to someone else’s resource. Rare, but sometimes happens after support hands off URLs.

This is a feature, not a bug

Cross-tenant denial is the single most important security guardrail in VibeCord. It’s why a hostile user can’t just guess project IDs and read your bot’s source code. We log every denial — both for our own monitoring and (in serious cases) for our compliance audit trail.

What to try

1. Sign in with the right account. If you have multiple Discord accounts, sign out and back in with the one that owns the resource. Your dashboard will show your actual projects.

2. Ask the owner for a share link. From the project page, the owner can click Share and generate a read-only or collab link. Open the link from your account.

3. Check the URL. If you copy-pasted a URL, make sure it’s your dashboard URL (not your teammate’s).

4. If you used to own this (e.g. team handoff): contact the new owner. They can re-invite or transfer back.

Open my dashboard

Why we don’t surface “owned by Alice” in the error

We deliberately keep the error generic (CROSS_TENANT_DENIED, no leak of who the actual owner is). Telling you “this belongs to alice@example.com” would leak account membership data. Instead, we say “not yours” and stop.

If you have a legitimate reason to find the owner (e.g. you bought a domain that points to their bot), email legal@vibecord.dev with proof and we’ll mediate.

When to contact support

If you genuinely should have access (you’re the owner, not a teammate):

• Email support@vibecord.dev with your account email and the URL that failed
• Or Discord

We can audit who actually owns the resource and walk you through correcting it. We will not hand off ownership without verifying both parties.