72de7b9a22
Re-review (completeness sweep + Codex) found: Audit\Index::saveRetention wrote the global
audit_retention_days policy ungated (a non-admin could shrink retention and prune audit evidence)
-> manage-panel guard + @can-hidden control; Settings\Email::sendTest lacked the role guard that
mount/save already had -> manage-panel; DetectHoneytoken read only form-encoded bodies via post(),
missing a JSON {"api_key":"<canary>"} replay -> now scans json() too (still body-only, no query).
|
||
|---|---|---|
| .. | ||
| BlockBannedIp.php | ||
| DetectHoneytoken.php | ||
| EnsureSecurityOnboarded.php | ||
| PanelScheme.php | ||
| SecurityHeaders.php | ||
| SetLocale.php | ||
| VerifyTerminalSidecarSecret.php | ||