14 lines
564 B
JSON
14 lines
564 B
JSON
{
|
|
"feature_id": "F-099",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "SMTP credentials stay server-side; reset tokens are single-use and only travel in the emailed link; no secrets leak in API responses.",
|
|
"evidence": [
|
|
"smtpPass is never returned by settings GET (smtpPassConfigured flag only)",
|
|
"Reset request keeps existing rate limiting and does not enumerate users",
|
|
"Session cookie remains httpOnly; new account routes reuse authenticate()",
|
|
"PUBLIC_APP_URL default is HTTPS"
|
|
],
|
|
"timestamp": "2026-08-21T05:29:30Z"
|
|
}
|