Danijel Martinek 2747feab46 fix(auth): stop leaking usernames via emailDomain span attribute ...

getUserByUsername emitted the FULL username as the emailDomain span
attribute whenever the username contained no "@" (audit finding B6),
violating the PII-free telemetry rule (ADR-017 §7). Emit only a boolean
hasAtSign in both the production repository and its mock; regression
tests pin that no username-derived string reaches span attributes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-10 17:22:00 +02:00

..

src

fix(auth): stop leaking usernames via emailDomain span attribute

2026-07-10 17:22:00 +02:00

tests

feat(auth): add signIn rate-limit backfill with dual ip/account budgets

2026-05-20 09:22:41 +00:00

AGENTS.md

docs(adr): rename ADR-012 — drop Lazar; update title + content + cross-refs

2026-05-13 10:07:37 +02:00

CHANGELOG.md

feat: hybrid versioning + automated CHANGELOG via release-please

2026-05-13 17:17:16 +02:00

eslint.config.js

refactor: rename eslint-config + typescript-config to core-eslint + core-typescript

2026-05-05 10:37:07 +02:00

package.json

build: bump vitest past GHSA-5xrq-8626-4rwp; coverage-v8 everywhere

2026-07-10 16:44:48 +02:00

stryker.config.json

feat(coverage): pnpm mutate (Stryker) + L3 implementation

2026-05-13 16:31:30 +02:00

tsconfig.json

refactor: rename eslint-config + typescript-config to core-eslint + core-typescript

2026-05-05 10:37:07 +02:00

turbo.json

feat(auth): scaffold empty package with feature tag + path aliases

2026-05-05 00:37:13 +02:00

vitest.config.ts

feat(core-shared/conformance): manifest coverage schema + vitest helper

2026-05-13 13:51:13 +02:00