Author here. A trailing space in a column name was enough to bypass a security check I'd written to protect a multi-tenant column. The fix was trivial. The architectural problem wasn't. Wrote about what I changed and why.