fix: solve risk assessment issue

Author: Bulletdev

app/models/concerns/organization_scoped.rb

@@ -13,8 +13,9 @@ module OrganizationScoped
       if org_id.present?
         where(organization_id: org_id)
       else
-        Rails.logger.warn("[SCOPE] OrganizationScoped: Current.organization_id is nil for #{name}")
-        all
+        # SECURITY: Fail-safe - retorna scope vazio em vez de expor dados de todas as orgs
+        Rails.logger.error("[SECURITY] OrganizationScoped: organization_id is nil for #{name} - BLOCKING ACCESS")
+        where('1=0')
       end
     }
   end

app/modules/dashboard/controllers/dashboard_controller.rb

@@ -163,9 +163,9 @@ def roster_status_data
       def fetch_recent_activities
         # Fetch recent audit logs and format them.
         # includes(:user) preloads the user in one query — avoids N+1 on log.user&.email
-        activities = AuditLog
+        # SECURITY: Use organization_scoped helper for consistent scoping
+        activities = organization_scoped(AuditLog)
                      .includes(:user)
-                     .where(organization: current_organization)
                      .order(created_at: :desc)
                      .limit(20)