William DrakeandClaude Opus 5.5 b1ce3c6d59 fix(email): atomic verify-code attempts and hashed single-use reset tokens ...

- Verification code attempts (register + notify email) are now reserved via
  an atomic Redis INCR (Lua) before comparing, so concurrent wrong guesses
  cannot exceed the 5-attempt cap.
- Password reset tokens are stored as SHA-256 hashes and consumed with an
  atomic Lua compare-and-delete, so a token can only be used once even under
  concurrent requests.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-28 12:26:28 -04:00

..

config

…

domain

…

handler

fix(email): atomic verify-code attempts and hashed single-use reset tokens

2026-09-28 12:26:28 -04:00

integration

…

middleware

…

model

…

payment

…

pkg

Merge pull request #7638 from Achordchan/fix/anthropic-structured-output-beta

2026-09-28 10:52:52 +08:00

platform/liveattestation

…

repository

fix(email): atomic verify-code attempts and hashed single-use reset tokens

2026-09-28 12:26:28 -04:00

securityaudit

…

server

…

service

fix(email): atomic verify-code attempts and hashed single-use reset tokens

2026-09-28 12:26:28 -04:00

setup

…

testutil

…

util

…

web

…