Logout now requires Authorization: Bearer <access-token>.

Security-audit.md

@@ -42,13 +42,15 @@ The application should remain behind the production reverse proxy, with real DNS
 
 ### SA-001: Logout uses non-standard token transport
 
-**Severity:** High  
-**Evidence:** `POST /api/auth/logout` accepts `{"token": ...}` in the JSON request body, and the web frontend sends the access token this way.  
+**Severity:** High, remediated in current worktree
+**Evidence before remediation:** `POST /api/auth/logout` accepted `{"token": ...}` in the JSON request body, and the web frontend sent the access token this way.
 **Impact:** Request bodies may be captured by debugging middleware, application logs, or monitoring systems. The endpoint also diverges from the bearer-header contract used elsewhere, increasing the chance of inconsistent token handling.
 
-**Recommendation:** Make logout use `Authorization: Bearer <access-token>` and revoke the authenticated token or its family server-side. If a compatibility period is required, support both forms temporarily, prefer the header, and remove the body form after client migration. Add tests proving body-only tokens are rejected once compatibility is removed.
+**Current state:** Logout requires `Authorization: Bearer <access-token>`, rejects body-only tokens with `401`, and revokes the token family server-side. The web frontend and Firefox extension send the header; regression coverage verifies access and refresh tokens are invalid after logout.
 
-**Priority:** High.
+**Recommendation:** Keep logout header-only, retain family revocation, avoid logging authorization headers, and rotate legacy sessions issued before this change.
+
+**Priority:** Completed in code; legacy session rotation and log hygiene remain.
 
 ### SA-002: Raw infrastructure errors are returned to clients