-
Let a plain form log in
-
Name the class of email you cannot opt out of, in code and to the user
-
Read notification preferences from subscriptions, not columns
-
Choose rate limits at runtime, so CI tests the limiter that ships
-
Alert on security signals instead of accumulating them
-
Exorcise sweep: strip AI tells from server copy, comments, and docs
-
server: adopt lint block, fix clippy, fmt
-
Bump the tower/axum middleware cluster (server, kberg)
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Decompose AppState Phase 2: finish auth + retire spawn_email!
-
Decompose AppState Phase 2: migrate auth, sso, embed to slices
-
Group Config and AppState into cohesive sub-structs
-
Remediate audit Run 22 fix-first findings; bump to 0.10.8
-
Frontend: kill media-picker XSS; render_string surfaces errors
-
Run CPU-bound Argon2 off the async runtime (ultra-fuzz Run 10 C1)
-
server: govern OAuth read routes; harden passkey + password-verify paths