Forced scoping on a nested route binding

A nested route binding resolved both models independently, so a request for one customer’s order under another customer’s URL returned the order.

// /customers/{customer}/orders/{order}
// 8.x: resolves Order::find($order) — no relationship check

Route::get('/customers/{customer}/orders/{order}', $handler)
    ->scopeBindings();

// 9.x: resolves $customer->orders()->find($order), so a
// mismatched pair is a 404 rather than a leak.

// or on a group, which is what you actually want
Route::scopeBindings()->group(function () { /* ... */ });

The unscoped behaviour is an authorisation bug that looks like routing, and it was the default for years — a policy check on the order will usually catch it and only if the policy checks ownership rather than a capability. Applying scopeBindings to the group rather than per route is the version that does not get forgotten on the next endpoint.