72de7b9a22
Re-review (completeness sweep + Codex) found: Audit\Index::saveRetention wrote the global
audit_retention_days policy ungated (a non-admin could shrink retention and prune audit evidence)
-> manage-panel guard + @can-hidden control; Settings\Email::sendTest lacked the role guard that
mount/save already had -> manage-panel; DetectHoneytoken read only form-encoded bodies via post(),
missing a JSON {"api_key":"<canary>"} replay -> now scans json() too (still body-only, no query).
|
||
|---|---|---|
| .. | ||
| components | ||
| errors | ||
| layouts | ||
| livewire | ||
| partials | ||
| vendor/wire-elements-modal | ||
| update-progress.blade.php | ||