5 Commits

Include renames

Author	SHA1	Message	Date
Thanakorn	73c680e844	Harden sign-in and password reset ... - OTP attempt limits, constant-time compare, random reference codes - DB-backed rate limits (429) on sign-in, OTP, reset, register, onboarding - one generic sign-in failure message; reset request no longer reveals accounts - no password kept in the session; real status codes on failures	2026-09-24 14:53:40 +07:00
Thanakorn	e579dd596c	Start every session through session.php; idle timeout, app access and auth status codes	2026-09-24 14:30:35 +07:00
Thanakorn S	5ca6b49fd0	code audit fixes: require_once, issue flow, role guards	2026-05-23 17:06:08 +07:00
Thanakorn S	a75d37e841	closing security gap [ignore guarding change for now]	2026-05-07 10:29:14 +07:00
Thanakorn S	d8c55d278a	app settings	2026-04-27 10:50:31 +07:00