amadan
step2/seal-and-secrets
No description yet.
Commits
23
Files changed
52
+7513 −78
Discussions
0
0 open
Tasks
0/0
done
Discussions
- No discussions on this branch yet.
Tasks
- No tasks yet.
Activity
- paul@keymail.dev pushed d826fc4 Say what the CSP sweep actually covers, measured rather than reasoned
- paul@keymail.dev pushed 6b1c02c Measure the sweep's reach instead of reasoning about it
- paul@keymail.dev pushed 4d6f923 Answer the final review: the sweep now reaches the routes it claimed to
- paul@keymail.dev pushed 013331d Close the stub's timeout gap, and test the wiring the stub cannot
- paul@keymail.dev pushed 3634208 Answer the confirmation review: three claims that outlived what they described
- paul@keymail.dev pushed 099582e The script sweep reports the right reason for a single-quoted src
- paul@keymail.dev pushed d39fc86 Answer the third review: four gates that did not guard what they claimed
- paul@keymail.dev pushed f945e66 Test the callback's browser binding instead of asserting it in a comment
- paul@keymail.dev pushed 311b95a Ruling A gets a second opinion, and it corrected this plan
- paul@keymail.dev pushed bd3e7d7 Draft the §13 step 3 plan: assertions, the redirect protocol, gate 3
- paul@keymail.dev pushed 903eb7b Enrolling a passkey needs a fresh session, or a stolen cookie is a permanent lockout
- paul@keymail.dev pushed 3211100 Cite the edge's X-Forwarded-For contract instead of paraphrasing it
- paul@keymail.dev pushed 05376b0 Pin the fact that RequireFresh is not the same as a real assertion
- paul@keymail.dev pushed bd98ac0 AGENTS.md: gates 1 and 2 have their database now
- paul@keymail.dev pushed 0ba212f Scriptless sign-in screens, and the guard that the RP ID is a full host
- paul@keymail.dev pushed c07d9de Answer the second review: two gates that could not fail, three claims that were false
- paul@keymail.dev pushed 3328173 Passkeys as an optional second factor, gated on both sign-in paths
- paul@keymail.dev pushed 494db92 Sign-in through signin.Flow, with the link redeemed on POST
- paul@keymail.dev pushed e41d43c Answer the Task 1 review, and land the sealed link store
- paul@keymail.dev pushed 9209153 Open the database, and prove secure_delete reaches every connection
- paul@keymail.dev pushed bbe7604 The person ref: opaque, minted, never derived from an address
- paul@keymail.dev pushed 65bafa8 The schema with no address column, and the guard that says so
- paul@keymail.dev pushed 53430d0 Seal values at rest, load the four secrets, and the plaintext gate that proves it