djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, "djust.tenants" isolation was enforced only on the HTTP path. The current tenant was stored in "threading.local()" and set exclusively by the HTTP-only "TenantMiddleware", so on the live (WebSocket/SSE) path "get_current_tenant()" was always "None" during mount and every event handler — and the tenant-aware "QuerySet" manager failed OPEN (returned the unfiltered queryset, ignoring "STRICT_MODE"), disclosing every tenant's rows to whoever held the socket. "threading.local" was additionally shared across connections on the "sync_to_async" executor thread. This issue is fixed in djust 1.0.7. Tenant storage moved to a "contextvars.ContextVar" (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (".none()" under the default "STRICT_MODE"); and system check S006 warns when "STRICT_MODE=False". No known workarounds are available on the live path.