2 Commits

Author	SHA1	Message	Date
John Cardinal	26173b3926	Security review pass 2: login, tokens, password reset, 2FA, anonymous routes ... F5 (critical, confirmed on the local server): the 2FA step accepts an empty or missing temp token, so users with 2FA on can be logged into without a password. F1 confirmed: with the placeholder secret a user's current token can be rebuilt. F8 confirmed. New findings F6, F7, F9 to F12. Review only, no code changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 19:24:45 -07:00
John Cardinal	2a9664dbe0	Security review pass 1: scope, threat model, attack-surface map, first candidate findings ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 18:00:18 -07:00