{"task_id":"tenant-export-auth","bad_review":"Looks fine to me.","good_review":"This route is missing both require_admin and require_account_scope, so another tenant's invoices can be exported by passing an arbitrary account_id."}