v1.1.0
First post-prod-deploy release cycle. Closes the security debt that was deliberately deferred during the Production v1 push so the deploy could ship: the auth model rewrite (session-based auth, CSRF re-enable, session revocation, login rate limiting). Hard cutover release — all in-flight sessions are invalidated on deploy. Anchored by the two replacement issues for #522 (session model cutover + defense-in-depth). Closes when both ship and the AuthTokenCookieFilter is fully removed from the codebase.
No due date
0% Completed
