72de7b9a22
Re-review (completeness sweep + Codex) found: Audit\Index::saveRetention wrote the global
audit_retention_days policy ungated (a non-admin could shrink retention and prune audit evidence)
-> manage-panel guard + @can-hidden control; Settings\Email::sendTest lacked the role guard that
mount/save already had -> manage-panel; DetectHoneytoken read only form-encoded bodies via post(),
missing a JSON {"api_key":"<canary>"} replay -> now scans json() too (still body-only, no query).
|
||
|---|---|---|
| .. | ||
| Email.php | ||
| Index.php | ||
| LoginProtection.php | ||
| Profile.php | ||
| Security.php | ||
| Sessions.php | ||
| Users.php | ||
| WebauthnKeys.php | ||