xarmian 0dc3f0b61f fix: address Codex review findings for TOTP 2FA ...

- Reject API token auth on 2FA enrollment endpoints (setup, verify,
  disable) to prevent account takeover via leaked tokens (P1)
- Re-read 2FA challenge secret after persisting to handle multi-instance
  startup race on fresh databases (P2)

2026-04-08 21:36:48 +00:00

..

cli

fix: address 6 security findings from Codex review of TOTP 2FA

2026-04-08 20:30:39 +00:00

collections

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

config

feat: implement SSE connection limits

2026-04-06 01:23:34 +00:00

diff

Initial release

2026-03-26 01:52:36 +00:00

email

feat: account settings, email infrastructure, and UX polish (#23)

2026-03-29 18:29:52 -04:00

events

fix: resolve Codex review findings across SSE, audit, metrics, and deployment

2026-04-07 01:13:44 +00:00

items

Add move item between collections with field migration

2026-03-28 05:01:40 +00:00

links

Initial release

2026-03-26 01:52:36 +00:00

logging

feat: add readiness probe and structured logging (TASK-161)

2026-04-05 15:02:54 +00:00

metrics

fix: resolve Codex review findings across SSE, audit, metrics, and deployment

2026-04-07 01:13:44 +00:00

models

feat: add TOTP two-factor authentication

2026-04-08 20:30:39 +00:00

server

fix: address Codex review findings for TOTP 2FA

2026-04-08 21:36:48 +00:00

store

fix: persist 2FA challenge key and prevent duplicate TOTP verification

2026-04-08 20:30:39 +00:00

webhooks

feat: add readiness probe and structured logging (TASK-161)

2026-04-05 15:02:54 +00:00