The exposed credential file is removed; revocation remains
The untracked root-level plaintext credential file was permanently removed without printing its value. Local deletion cannot invalidate the credential or prove it was never copied.
Understand / Audit
A 23 August 2026 audit and remediation snapshot based on source inspection, database acceptance, dependency audit, typecheck, lint, browser, and production-build results.
Verification snapshot
A green build is not the same as production readiness. Results below distinguish executable checks from policy and product gaps.
| Surface | Check | Result |
|---|---|---|
| OpenAPI | Lint + documentation coverage + bundle | 116 operations and 130 schemas documented |
| Go backend | Unit + PostgreSQL acceptance, including migrations, idempotency, OAuth/OIDC, Resource Servers, grants, decisions, Support Cases, and revocation | Pass |
| Three SDKs | Typecheck + Vitest + build | 8 tests pass; all gates pass |
| Console | Typecheck + lint + production build + browser | 3 browser flows pass, including identity, delegated OAuth, credentials, and Support Cases |
| Console | npm audit | 0 known vulnerabilities |
| Next.js example | Typecheck + env-free build | Pass |
| Docs | Astro check + links + accessibility + browser | Pass |
| Other JavaScript repos | npm audit | No known vulnerabilities reported |
Prioritized register
Each item includes the observed evidence and a completion bar, so the register can become an implementation backlog.
The untracked root-level plaintext credential file was permanently removed without printing its value. Local deletion cannot invalidate the credential or prove it was never copied.
The server no longer registers or publishes password-only and passkey-only session endpoints. Password-verified first-FIDO enrollment now bootstraps new users without creating a password-only session.
The adapter sends one selfie to an external template service and accepts a boolean match. It cannot support a spoof-resistance claim.
RedisReferenceStore accepts the official Redis client surface, uses backend expiry for TTL, rejects malformed records, and shares references across BFF instances.
Console source IPs, console identities, Project login starts, and Project password checks use separate PostgreSQL policies. Records contain keyed digests instead of raw identifiers, counters are capped, windows expire, and authentication fails closed if enforcement is unavailable.
Next.js was upgraded to 16.3.1, sharp resolves to 0.35.3, and nanoid is overridden to 3.3.18. npm reports zero known vulnerabilities.
Startup serializes migration work, seals applied SQL with SHA-256 checksums, and rejects changed or missing history. A PostgreSQL idempotency store coordinates processing leases, request hashes, exact responses, stale owners, retention, and cleanup.
Health operations explicitly opt out of global authentication, Project User detail documents passkeys, generated Go and console types are synchronized, and docs CI fails on snapshot drift. Only a real production API server URL remains unavailable.
The base TypeScript configurations cover source and tests without an incompatible rootDir, while build configurations still emit src-only packages.
Each SDK gates locked install, typecheck, tests, build, package dry-run, and audit. The Next example builds without secrets and the framework recipe repository validates its supported examples.
Its dynamic route now initializes ComplicatedAuthServer lazily, so static rendering and production build do not require secret placeholders.
Remix and SvelteKit BFF recipes use RedisReferenceStore, include threat guidance, and link to the dedicated Next.js example.
Verification and password-reset requests are deliberately non-enumerating and rate limited across replicas. One-time proofs are hashed, prior proofs are invalidated, delivery content is encrypted, and SMTP delivery runs asynchronously through the leased job queue. Password reset revokes console sessions and OAuth artifacts, deletes management WebAuthn credentials, and requires fresh enrollment.
Signup and invitation acceptance create bootstrap sessions with no ordinary management authority. A non-enumerating login attempt verifies the password without creating a session; only user-verified WebAuthn creates strong assurance. Credential metadata is bounded and safe, mutations use ETags, the final authenticator is protected, and registration excludes existing credential identifiers.
Tenants support owner, admin, developer, support, and viewer roles. API middleware enforces permissions, invitations use one-time tokens and idempotent creation, member disablement revokes sessions, and final-owner invariants are transactionally protected.
Tenant operators manage one inbox while scoped Project service credentials can create and read only their Project's public correspondence. Cases use structured lifecycle fields, ETags, idempotent mutations, encrypted content, constrained attachments, generic external references, immutable events, and explicit retention deadlines.
Origins are folded into Settings rather than a first-class section, and the acceptance flow does not exercise every detailed user-administration or activity-pagination path. Service-account creation, issuance, overlap, scope enforcement, revocation, and disablement are covered.