OTP security hardened

2026-08-26 18:24:02 +02:00
parent c3c3c8e1a6
commit 580c2a4257
13 changed files with 227 additions and 13 deletions
@@ -184,6 +184,8 @@
 180. Implement SA-006: remove broad Firefox extension host access and unnecessary tabs permission, request exact configured backend origin access, and keep page capture behind activeTab.
 181. Continue to document every prompt and chat in the VIBE directory.
 182. Continue SA-006: store session credentials in the narrowest available extension storage, minimize token lifetime, support refresh-token rotation, and clear all session material on logout or token invalidation.
+183. Also allow an admin to reset (disable) OTP for any user.
+183. Fix SA-009: TOTP enrollment has no recovery codes or reset workflow.
 183. Address SA-007 and use linklog.example.com as the default LINKLOG_PUBLIC_URL.

 ## Future entries