Matthew Knight 199642242f Fix security vulnerabilities identified in pre-deployment audit ... - Regenerate session ID on login to prevent session fixation (H1) - Add mutex to login lockout counters to fix race condition (H2) - Validate issuer/audience claims on Apple ID tokens (M2) - Verify comment belongs to ticket's issue to prevent attachment IDOR (M4) - Stop SSO from re-approving admin-disapproved users (M3) - Add Content-Security-Policy header (M1) - Configure trusted proxies via TRUSTED_PROXIES env var (M6) - Cap password length at 128 for bcrypt truncation (L1) - Set Secure flag on flash cookies over HTTPS (L2) - Rate-limit POST /reset-password (L3) - Add authenticated password change at /account/password (L4) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>		2026-02-18 12:30:23 -08:00
..
admin	Unify UI	2026-02-17 11:01:34 -08:00
tickets	Drag and drop attachments	2026-02-16 00:58:04 -08:00
change-password.html	Fix security vulnerabilities identified in pre-deployment audit	2026-02-18 12:30:23 -08:00
forgot-password.html	Init	2026-02-12 15:00:17 -08:00
home.html	Init	2026-02-12 15:00:17 -08:00
login.html	Setting up webhooks	2026-02-13 23:05:42 -08:00
register.html	Improvements	2026-02-14 00:19:49 -08:00
reset-password.html	Init	2026-02-12 15:00:17 -08:00