security: complete the 2.4.0 pre-release audit (AUDIT-06 to AUDIT-22) - #751

Merged

lakhansamani merged 9 commits into

mainfrom

security/2.4.0-audit-part-2

Aug 7, 2026

Commits on Aug 7, 2026

security: bind oauth state to browser and codes to clients
lakhansamani
committed
25c3dfe
security: hash session tokens at rest, fix at_hash alg and CORS
lakhansamani
committed
2f81a04
security: fail closed on unevaluable agent constraint, close signup oracle
lakhansamani
committed
e70c0b7
test: pin the signup x email-verification invariant across all combinations
lakhansamani
committed
bc406e0
fix(make): test-all-db leaked containers on failure and raced DB startup
lakhansamani
committed
cf10f96
fix(make): apply the readiness and teardown fix to every per-DB target
lakhansamani
committed
3608bcf
style: keep the EncryptPassword doc comment on its function
lakhansamani
committed
c208004
fix(config): reject a mistyped --app-cookie-same-site instead of silently using lax
lakhansamani
committed
f21eb44
fix(verify-email): set email_verified_at in the REST handler too
lakhansamani
committed
5655b74