boban 5ebee9b4a5 fix(webauthn): target a hardware security key (YubiKey), one-touch second factor ... Registration set no authenticatorSelection, so the browser offered the passkey-manager 'save passkey' flow (Bitwarden) instead of prompting for the YubiKey. Now request a cross-platform, non-resident, presence-only credential: authenticatorAttachment=cross-platform (roaming key, not a platform/manager passkey), residentKey=discouraged (non-discoverable second factor — what keeps passkey managers out), userVerification=discouraged (single touch, no PIN). Login assertion also uses discouraged so it is: insert key, one tap, done. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-19 21:23:01 +02:00
..
Console/Commands	feat(install): fixed default admin e-mail admin@clusev.local	2026-06-19 16:54:03 +02:00
Events	fix(blade): garbled header on every signed-in page + private metrics channel (v0.4.1)	2026-06-14 08:34:07 +02:00
Http	fix(tls): force https URL generation for the active domain (external-proxy mode)	2026-06-19 20:35:06 +02:00
Jobs	feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb	2026-06-12 00:31:50 +02:00
Livewire	fix(system): surface a failed restart sentinel write instead of a stuck state	2026-06-19 20:10:28 +02:00
Models	fix(security): harden brute-force, rate-limiting and auth-DoS (audit follow-up)	2026-06-17 17:59:45 +02:00
Notifications	fix(security): constant-time password-reset (flatten account-enumeration timing)	2026-06-15 19:16:30 +02:00
Providers	fix(security): harden brute-force, rate-limiting and auth-DoS (audit follow-up)	2026-06-17 17:59:45 +02:00
Services	fix(webauthn): target a hardware security key (YubiKey), one-touch second factor	2026-06-19 21:23:01 +02:00
Support	fix(security): harden brute-force, rate-limiting and auth-DoS (audit follow-up)	2026-06-17 17:59:45 +02:00