boban 217189598b fix(security): constant-time password-reset (flatten account-enumeration timing) ... Queues the reset-link notification so sendResetLink returns in constant time regardless of account existence; resetPassword does equivalent dummy verify work for unknown/no-2FA users. Closes the timing side-channels flagged on the forgot-password review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-15 19:16:30 +02:00
..
AuditEvent.php	feat: v1 data models + routes (Server/AuditEvent/SshCredential)	2026-06-12 06:25:47 +02:00
Server.php	chore(audit): full code sweep — fix open-redirect, drop dead code, clean docs	2026-06-13 12:54:26 +02:00
Setting.php	feat(security): dashboard hardening, credential mgmt, system domain/TLS + channel, self-hardening	2026-06-13 02:25:23 +02:00
SshCredential.php	chore(audit): full code sweep — fix open-redirect, drop dead code, clean docs	2026-06-13 12:54:26 +02:00
User.php	fix(security): constant-time password-reset (flatten account-enumeration timing)	2026-06-15 19:16:30 +02:00
WebauthnCredential.php	fix(webauthn): hash-indexed credential ids + reset keys on 2FA disable	2026-06-14 18:40:24 +02:00