Worked on enhancing security for the Leantime/leantime project by addressing a vulnerability in milestone access control. Focused on backend development using PHP, the developer implemented a fix for an Insecure Direct Object Reference (IDOR) in the getMilestone function. The solution introduced a project ownership check and validated user assignment to projects, ensuring that milestones are only accessible to authorized users. This approach aligned milestone access logic with existing ticket retrieval patterns, strengthening overall authorization and reducing risk. The work involved close collaboration with other contributors and referenced industry-standard security guidelines, demonstrating a methodical approach to improving application security and compliance.