fix(security): P0 remediation wave — SSRF guards, one-time-use, server-side passkey ceremony, lockout concurrency#159

Merged

windischb merged 3 commits into

fix/security-p0-remediation-wave

Jul 20, 2026

Commits on Jul 20, 2026

fix(security): apply existing SSRF + one-time-use guards where they were missing
windischb
committed
fix(security): move the web passkey ceremony server-side (P0-3)
windischb
committed
fix(security): make the account-lockout counter concurrency-safe (P0-4)

windischb
and
claude
committed