diff --git a/tasks/serializers.py b/tasks/serializers.py
index 8710bd8..305f645 100644
--- a/tasks/serializers.py
+++ b/tasks/serializers.py
@@ -65,6 +65,13 @@ class TaskSerializer(serializers.ModelSerializer):
     total_time_spent = serializers.ReadOnlyField()
     parent_sync_id = serializers.UUIDField(source='parent.sync_id', read_only=True, allow_null=True)
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # SECURITY: Filter tag queryset to only include tags owned by the current user
+        request = self.context.get('request')
+        if request and hasattr(request, 'user') and request.user.is_authenticated:
+            self.fields['tag_ids'].queryset = Tag.objects.filter(user=request.user)
+
     class Meta:
         model = Task
         fields = [