fix: harden session sealing, log redaction, and webhook tolerance checks#482

Merged

gjtorikian merged 15 commits into

mainfrom

May 12, 2026

Commits on May 7, 2026

fix(session): guard nil/empty cookie_password in SessionManager seal helpers

gjtorikian
and
claude
committed
fix(session): require exp claim on access-token JWT decode

gjtorikian
and
claude
committed
fix(session): persist seal_data before decoding refreshed access token

gjtorikian
and
claude
committed
fix(session): require cookie_password.bytesize >= 32 at every entry point

gjtorikian
and
claude
committed
fix(base_client): redact bearer-token path segments before logging

gjtorikian
and
claude
committed
fix(actions): use symmetric tolerance check for verify_header timestamp

gjtorikian
and
claude
committed
fix(webhooks): use symmetric tolerance check for verify_header timestamp

gjtorikian
and
claude
committed
fix(user_management): strip caller-supplied PKCE params in get_authorization_url_with_pkce

gjtorikian
and
claude
committed

Commits on May 8, 2026