Repository navigation

Complete security hardening and MFA enforcement - #62

Merged

SamRepository25 merged 39 commits into

mainfrom

security/complete-hardening-20260922

Sep 22, 2026

Merged

Complete security hardening and MFA enforcement#62
SamRepository25 merged 39 commits into
mainfrom
security/complete-hardening-20260922

Commits on Sep 22, 2026
- security: 20260922230000_complete_security_hardening.sql
  SamRepository25
  committed
  4bdb214
- security: security.yml
  SamRepository25
  committed
  ee1b465
- security: remove hard-coded admin identity and scope login lockout by IP
  SamRepository25
  committed
  ee17c30
- security: require MFA setup after admin password login
  SamRepository25
  committed
  82b75f6
- security: support mandatory MFA setup flow
  SamRepository25
  committed
  00ba51b
- security: add mandatory MFA setup route
  SamRepository25
  committed
  d598eea
- security: require MFA on all authenticated admin routes
  SamRepository25
  committed
  de584aa
- security: validate Turnstile action and hostname
  SamRepository25
  committed
  2f00578
- security: bind Turnstile widgets to explicit actions
  SamRepository25
  committed
  47f794e
- security: make contact rate limiting atomic
  SamRepository25
  committed
  07f2c9b
- chore: remove obsolete contact rate limit constants
  SamRepository25
  committed
  45e21eb
- security: bind contact Turnstile action
  SamRepository25
  committed
  6da1926
- security: bind comment Turnstile action
  SamRepository25
  committed
  78ae3d1
- security: escape blog JSON-LD output
  SamRepository25
  committed
  35879c7
- security: use CSPRNG for recovery codes
  SamRepository25
  committed
  7981641
- security: document Turnstile hostnames and login salt
  SamRepository25
  committed
  ecf44d1
- test: extend security regression coverage
  SamRepository25
  committed
  ff21392
- chore: add contact security RPC to Supabase types
  SamRepository25
  committed
  db03086
- chore: add recovery code table types
  SamRepository25
  committed
  62bc57c
- security: make admin MFA non-disableable
  SamRepository25
  committed
  c981d91
- docs: clarify mandatory administrator MFA
  SamRepository25
  committed
  2de9e44
- security: use role-based admin authorization for MFA functions
  SamRepository25
  committed
  b7bc66d
- security: enforce admin-only MFA verification flow
  SamRepository25
  committed
  53765f2
- docs: update admin MFA capability comment
  SamRepository25
  committed
  203d1b4
- security: require AAL2 for edit mode
  SamRepository25
  committed
  59c1fb5
- security: bind auth Turnstile action
  SamRepository25
  committed
  211cbb8
- security: bind comment Turnstile action
  SamRepository25
  committed
  8fdcf3f
- security: prefer Vercel trusted client IP header
  SamRepository25
  committed
  35ee157
- security: replace nonfunctional recovery codes with backup TOTP enrollment
  SamRepository25
  committed
  0274051
- security: use backup TOTP factors instead of nonfunctional recovery codes
  SamRepository25
  committed
  e13cd7a
- security: allow backup TOTP factor selection at login
  SamRepository25
  committed
  a37aa0b
- security: remove unused custom recovery-code implementation
  SamRepository25
  committed
  8b16b49
- docs: remove misleading recovery-code setup text
  SamRepository25
  committed
  39f15d0
- security: use CSPRNG for guest visitor identifiers
  SamRepository25
  committed
  0412533
- security: validate Turnstile against deployment hostname
  SamRepository25
  committed
  7beb47e
- security: remove unsupported custom recovery-code store
  SamRepository25
  committed
  49d0652
- chore: remove obsolete recovery-code table types
  SamRepository25
  committed
  53041ac
- test: remove obsolete recovery-code table assertions
  SamRepository25
  committed
  7e19aeb
- ci: avoid failing on pre-existing repository-wide formatting debt
  SamRepository25
  committed
  737b1af

Commits

Commits on Sep 22, 2026