Fix the first security audit's findings - #14

Merged

nedtwigg merged 5 commits into

mainfrom

Sep 23, 2026

Commits on Sep 23, 2026

Hash Better Auth rate-limit keys and stop trusting a client IP header (audit Q1)

nedtwigg
and
claude
committed
22b6fde
Narrow the OAuth error-detail rule to what diagnostics records (audit Q2)

nedtwigg
and
claude
committed
c922897
Pin the live auth controls no test exercised (audit Q7)

nedtwigg
and
claude
committed
a6c077d
Contain the migrations path and state three unstated limits (audit Q3, Q4, Q5, Q8)

nedtwigg
and
claude
committed
b4e71d3
Group IPv6 by /64 in pgstencil's send:ip budget, as Better Auth does

nedtwigg
and
claude
committed
72f75e8