shankar0123 fbcac8d193 Merge Fix 02 (CRIT A-2): close MED-11 lying field — DeactivatedAt loaded + enforced on login

2026-05-11 11:16:07 +00:00

..

api

fix(auth/users): close MED-11 lying field — DeactivatedAt loaded + enforced on login (A-2)

2026-05-11 02:21:05 +00:00

auth

fix(auth/users): close MED-11 lying field — DeactivatedAt loaded + enforced on login (A-2)

2026-05-11 02:21:05 +00:00

cli

auth-bundle-1 Phase 8 follow-up: classify issuer/target audit rows + auditor end-to-end tests + gofmt drift

2026-05-09 20:23:41 +00:00

cms

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

config

harden(oidc): pre-login UA/IP binding (MED-16) — RFC 9700 §4.7.1

2026-05-10 23:18:23 +00:00

connector

2026-05-05 18:18:29 +00:00

crypto

security(signer): bound FileDriver paths with SafeRoot + reject .. (CodeQL #27, CWE-22)

2026-05-04 05:04:35 +00:00

deploy

2026-05-05 18:18:29 +00:00

domain

feat(auth/rbac): scope_type+scope_id+expires_at on role grants (HIGH-10)

2026-05-10 22:47:45 +00:00

integration

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

mcp

feat(mcp): 11 audit-fix MCP tools — approvals, break-glass, bootstrap, audit-category (MED-13)

2026-05-10 23:37:06 +00:00

pkcs7

2026-05-05 18:18:29 +00:00

ratelimit

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

repository

Merge Fix 02 (CRIT A-2): close MED-11 lying field — DeactivatedAt loaded + enforced on login

2026-05-11 11:16:07 +00:00

scep/intune

security(scep-intune): annotate verifyES256/RS256 SHA-256 as RFC-mandated (CodeQL #21 false positive)

2026-05-04 05:08:02 +00:00

scheduler

fix(oidc/bcl): jti replay-cache + iat freshness check (HIGH-3 closure)

2026-05-10 20:53:29 +00:00

secret

secret: migrate EJBCA / GlobalSign / Sectigo credentials to *secret.Ref (Phase 2)

2026-05-02 12:53:58 +00:00

service

fix(auth/rbac): close HIGH-10 lying field — EffectivePermissions reads actor-role scope (A-1)

2026-05-11 02:02:39 +00:00

tlsprobe

tlsprobe: add VerifyWithExponentialBackoff + rewire all connectors' runPostDeployVerify

2026-05-02 22:56:07 +00:00

trustanchor

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

validation

ci: convert literal Unicode in headers_test.go to \u escapes (ST1018)

2026-05-04 05:00:14 +00:00