Chris Farhood ecf4df88d3 security: require verified email for admin + harden sessions ...

Admin (email allowlist) is now gated on a verified email and re-evaluated per
request instead of trusting a frozen cookie flag; session max_age cut to 8h.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-07 10:39:05 -04:00

52 KiB

Raw Permalink History

View Raw