security: staging batch 3 (#272 #342 #341 #262 #269 #325 #326 #335) - #513

Open

gonzalesedwin1123 wants to merge 10 commits into

19.0from

19.0-staging-sec-batch3

Commits on Sep 10, 2026

security(cel): key metric cache lookups strictly by requested params (#272)
gonzalesedwin1123
authored
f3b6430
fix(cel): recognise 'me' as a context identifier (dotted DCI validation false-positive) (#342)
gonzalesedwin1123
authored
9cc91fc
security(demo): deactivate default-credential demo users on production install + drop Production/Stable (#341)
gonzalesedwin1123
authored
2bc37da
security(hazard): restrict impact records to hazard/registry roles (#262)
gonzalesedwin1123
authored
4d6010f
security(dci): make OAuth token methods non-RPC and lock the token cache (#269)
gonzalesedwin1123
authored
d042f0c
security(dci): reject non-ASCII bearer tokens with 401 (avoid auth 500s) (#325)
gonzalesedwin1123
authored
670fcff
security(dci): purge stale compliance bearer token on upgrade (#326)
gonzalesedwin1123
authored
14c7fe3
security(registry): enforce configured search limits server-side in search_registrants (#335)
gonzalesedwin1123
authored
e428de5
security(hazard): gate stored registrant impact indicators and the affected-registrant list (fix-up for #262) (#514)
gonzalesedwin1123
authored
d482b38
Revert "security(demo): deactivate default-credential demo users on production install + drop Production/Stable (#341)" (#515)
gonzalesedwin1123
authored
3f367f2