feat(F-083): completed feature

work/artifacts/F-083/security.json

@@ -0,0 +1,19 @@
+{
+  "feature_id": "F-083",
+  "verdict": "APPROVED",
+  "checks": [
+    { "name": "No SQL injection", "result": "PASS", "notes": "All queries use $1..$N placeholders." },
+    { "name": "No token leakage in logs", "result": "PASS", "notes": "Only hash is logged in audit; raw token only in email body and URL." },
+    { "name": "Brute-force resistance", "result": "PASS", "notes": "Token is 32 bytes hex (256 bits); rate limit per IP and email; 1h TTL." },
+    { "name": "Timing equalisation for non-existing email", "result": "PASS", "notes": "noUserDelay adds ~80ms before returning." },
+    { "name": "Replay protection", "result": "PASS", "notes": "Token marked used_at = now() in same logical operation; second confirm returns 400." },
+    { "name": "Auth/RBAC unchanged", "result": "PASS", "notes": "Both endpoints public; admin Send reset link goes through existing combined auth." },
+    { "name": "Dependencies", "result": "PASS", "notes": "No new packages." }
+  ],
+  "sast": "PASS",
+  "dependency_review": "PASS",
+  "secret_scan": "PASS",
+  "verdict_reason": "Reset flow meets the standard security baseline for forgotten-password flows.",
+  "reviewer": "security",
+  "reviewed_at": "2026-08-20T04:09:30Z"
+}