shinkan-jinkendo

Author	SHA1	Message	Date
Lars	f10c28e5cd	Close medium exposure on reports, registration, uploads, and exercise HTML. Some checks failed Deploy Development / deploy (push) Successful in 59s Details Test Suite / pytest-backend (push) Failing after 47s Details Test Suite / lint-backend (push) Successful in 0s Details Test Suite / build-frontend (push) Successful in 17s Details Test Suite / k6 /health Baseline (push) Successful in 34s Details Test Suite / playwright-tests (push) Failing after 7m48s Details A superadmin can also turn off another account''s two-factor when the authenticator is lost. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-13 16:47:57 +02:00
Lars	32b28a93f3	Harden login, sessions, and media access before the dev deploy. Some checks failed Deploy Development / deploy (push) Successful in 49s Details Test Suite / pytest-backend (push) Successful in 47s Details Test Suite / lint-backend (push) Successful in 0s Details Test Suite / build-frontend (push) Successful in 15s Details Test Suite / k6 /health Baseline (push) Successful in 35s Details Test Suite / playwright-tests (push) Failing after 5m43s Details Limit brute-force attempts, require admin TOTP, and keep session tokens out of media URLs. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-13 07:45:53 +02:00