shankar0123 a4b2919f59 Merge Fix 13 (HIGH-2 fourth call site): CSRF rotation on Logout ...

# Conflicts:
#	CHANGELOG.md

2026-05-11 13:01:56 +00:00

..

api

Merge Fix 13 (HIGH-2 fourth call site): CSRF rotation on Logout

2026-05-11 13:01:56 +00:00

auth

chore(fmt): gofmt cleanup on files touched by audit-2026-05-11 fix bundle

2026-05-11 11:29:48 +00:00

cli

auth-bundle-1 Phase 8 follow-up: classify issuer/target audit rows + auditor end-to-end tests + gofmt drift

2026-05-09 20:23:41 +00:00

cms

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

config

harden(auth): demo-mode residual-grants detector + cleanup endpoint + CI guard (A-8)

2026-05-11 11:45:54 +00:00

connector

2026-05-05 18:18:29 +00:00

crypto

security(signer): bound FileDriver paths with SafeRoot + reject .. (CodeQL #27, CWE-22)

2026-05-04 05:04:35 +00:00

deploy

2026-05-05 18:18:29 +00:00

domain

feat(auth/rbac): scope_type+scope_id+expires_at on role grants (HIGH-10)

2026-05-10 22:47:45 +00:00

integration

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

mcp

fix(auth/rbac): scope-aware ActorRole revoke (A-4)

2026-05-11 10:50:34 +00:00

pkcs7

2026-05-05 18:18:29 +00:00

ratelimit

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

repository

Merge Fix 04 (HIGH A-4): scope-aware ActorRole revoke

2026-05-11 11:16:24 +00:00

scep/intune

security(scep-intune): annotate verifyES256/RS256 SHA-256 as RFC-mandated (CodeQL #21 false positive)

2026-05-04 05:08:02 +00:00

scheduler

fix(oidc/bcl): jti replay-cache + iat freshness check (HIGH-3 closure)

2026-05-10 20:53:29 +00:00

secret

secret: migrate EJBCA / GlobalSign / Sectigo credentials to *secret.Ref (Phase 2)

2026-05-02 12:53:58 +00:00

service

fix(auth/rbac): scope-aware ActorRole revoke (A-4)

2026-05-11 10:50:34 +00:00

tlsprobe

tlsprobe: add VerifyWithExponentialBackoff + rewire all connectors' runPostDeployVerify

2026-05-02 22:56:07 +00:00

trustanchor

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

validation

ci: convert literal Unicode in headers_test.go to \u escapes (ST1018)

2026-05-04 05:00:14 +00:00