gamertan/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 3 Activity

auth: publish audited password recovery
verify / verify (push) Successful in 3m7s
Details

Browse Source 
Publish the reviewed Gamertan Web Foundations v0.1.0-preview.4 snapshot with local-only administrative reset, atomic Argon2id credential replacement, mandatory rotation, all-session revocation, secret-free audit evidence, rollback coverage, and exact application-boundary guidance.

Exported from reviewed private source 403e5f6ef4d0cac683aaa76ed922236571d259a9 after trusted CI run 317 and exact Go 1.26.6 verification.

Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
gamertan
2026-08-18 09:31:08 -04:00
parent 5905fe6fb2
commit fb6bbd0dad
11 changed files with 241 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+6
View File
@@ -14,3 +14,9 @@ service-level agreement. There is no bug bounty.
The preview supports only versions explicitly listed in release notes. Security
claims stop at the documented trust boundaries and executable tests.
Password recovery is an explicitly local administrative capability. It must
not be wired directly to a public route. Applications using it are responsible
for local operator authorization and exclusive mode-`0600` credential delivery;
the library transaction requires a new password change, revokes all sessions,
and records a secret-free audit event.