The bit I keep coming back to is that this is authenticated SQLi in a feature called quick-note, so the blast radius is very different from the usual "one bad search box" story, but only if every deployment actually picked up the fix. The cloud vs self-hosted patch drift is the awkward part here, because with app-layer bugs like this the vulnerable surface can stay alive in forks or lagging installs long after the headline patch lands. If `search_term` is being dropped into a `LIKE` clause, I’d also want to know whether the fix was just parameterization or whether they had to deal with wildcard escaping too, since that’s often where the first "safe" patch still leaks behavior.