5 Commits

Include renames

Author	SHA1	Message	Date
Thanakorn	73c680e844	Harden sign-in and password reset ... - OTP attempt limits, constant-time compare, random reference codes - DB-backed rate limits (429) on sign-in, OTP, reset, register, onboarding - one generic sign-in failure message; reset request no longer reveals accounts - no password kept in the session; real status codes on failures	2026-09-24 14:53:40 +07:00
Thanakorn S	9e200d31fe	Security hardening: invited user onboarding flow (C1–N7)	2026-05-26 10:18:40 +07:00
Thanakorn S	5ca6b49fd0	code audit fixes: require_once, issue flow, role guards	2026-05-23 17:06:08 +07:00
Thanakorn S	f2b87cfd0f	fix onboarding bugs	2026-05-21 16:51:19 +07:00
Thanakorn S	6eeebfeacb	1) user invitation 2) app access control 3) txn quota guard	2026-05-21 11:42:47 +07:00