boban 3a67aa99ec fix(auth): rotate remember_token on reset + atomic recovery-code use ... Address Codex security review: - ForgotPassword + clusev:reset-admin now rotate remember_token, so a stolen remember-me cookie cannot survive a password reset (the email-token path already did this). - useRecoveryCode reads/checks/removes under a row lock (DB transaction + lockForUpdate), so two concurrent requests can't both spend the same one-time code (replay). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-14 17:04:12 +02:00
..
Install.php	feat(deploy): install.sh + Caddy auto-TLS + prod hardening	2026-06-12 15:17:32 +02:00
MockMetrics.php	feat: reference-depth dashboard (sparkline KPIs + live dual chart + table)	2026-06-12 14:44:11 +02:00
PollMetrics.php	fix(ssh): address adversarial review — host-key pinning, escaping, parsers	2026-06-12 21:55:27 +02:00
ResetAdmin.php	fix(auth): rotate remember_token on reset + atomic recovery-code use	2026-06-14 17:04:12 +02:00
SnapshotDomain.php	feat(domain): change the panel domain from the dashboard (v0.4.0)	2026-06-14 01:38:16 +02:00