Once revealed, the plaintext sits in the handoff cache for ten minutes, and the modal read it from the token alone. A former owner could keep pulling the key out of an open modal after revocation — the exact window purgeSecret() exists to close. Every request now re-checks the policy and drops the handoff when it no longer holds. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Admin | ||
| Auth | ||
| Concerns | ||
| Backups.php | ||
| Billing.php | ||
| Cloud.php | ||
| ConfirmCancelPackage.php | ||
| ConfirmCloseAccount.php | ||
| CustomerProvisioning.php | ||
| Dashboard.php | ||
| Invoices.php | ||
| Settings.php | ||
| Support.php | ||
| Users.php | ||