49 lines
1.4 KiB
JSON
49 lines
1.4 KiB
JSON
{
|
|
"feature_id": "F-083",
|
|
"verdict": "APPROVED",
|
|
"checks": [
|
|
{
|
|
"name": "No SQL injection",
|
|
"result": "PASS",
|
|
"notes": "All queries use $1..$N placeholders."
|
|
},
|
|
{
|
|
"name": "No token leakage in logs",
|
|
"result": "PASS",
|
|
"notes": "Only hash is logged in audit; raw token only in email body and URL."
|
|
},
|
|
{
|
|
"name": "Brute-force resistance",
|
|
"result": "PASS",
|
|
"notes": "Token is 32 bytes hex (256 bits); rate limit per IP and email; 1h TTL."
|
|
},
|
|
{
|
|
"name": "Timing equalisation for non-existing email",
|
|
"result": "PASS",
|
|
"notes": "noUserDelay adds ~80ms before returning."
|
|
},
|
|
{
|
|
"name": "Replay protection",
|
|
"result": "PASS",
|
|
"notes": "Token marked used_at = now() in same logical operation; second confirm returns 400."
|
|
},
|
|
{
|
|
"name": "Auth/RBAC unchanged",
|
|
"result": "PASS",
|
|
"notes": "Both endpoints public; admin Send reset link goes through existing combined auth."
|
|
},
|
|
{
|
|
"name": "Dependencies",
|
|
"result": "PASS",
|
|
"notes": "No new packages."
|
|
}
|
|
],
|
|
"sast": "PASS",
|
|
"dependency_review": "PASS",
|
|
"secret_scan": "PASS",
|
|
"verdict_reason": "Reset flow meets the standard security baseline for forgotten-password flows.",
|
|
"reviewer": "security",
|
|
"reviewed_at": "2026-08-20T04:09:30Z",
|
|
"agent": "security"
|
|
}
|