Issues

• BE-16 — Validate profile updates with an explicit allowlist

  Stellar Wave
  Akazajan/Oraculum#635 · Filter by author Qoder-Voidd opened on Oct 14, 2026
  3

  

• BE-15 — Make authorization failures consistent

  Stellar Wave
  Akazajan/Oraculum#633 · Filter by author Qoder-Voidd opened on Oct 14, 2026
  2

  

• BE-25 — Validate booking dates as strict ISO instants

  Akazajan/Oraculum#595 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-24 — Define account deletion data-retention behavior

  Akazajan/Oraculum#594 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-23 — Prevent self-demotion of the last super-admin

  Akazajan/Oraculum#593 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-22 — Audit administrative member-status changes

  Akazajan/Oraculum#592 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-21 — Clean up replaced profile images

  Akazajan/Oraculum#591 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-20 — Validate uploaded profile-image content

  Akazajan/Oraculum#590 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-19 — Preserve soft-delete behavior across authentication flows

  Akazajan/Oraculum#589 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-18 — Bound member-list query parameters

  Akazajan/Oraculum#588 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-17 — Normalize email comparisons consistently

  Akazajan/Oraculum#587 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-16 — Validate profile updates with an explicit allowlist

  Akazajan/Oraculum#586 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-15 — Make authorization failures consistent

  Akazajan/Oraculum#585 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-14 — Unify role definitions across auth and users

  Akazajan/Oraculum#584 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-13 — Add a 2FA recovery-code regeneration audit event

  Akazajan/Oraculum#583 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-12 — Enforce one-time backup-code consumption

  Akazajan/Oraculum#582 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-11 — Require 2FA confirmation before enabling it

  Akazajan/Oraculum#581 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-10 — Validate token configuration at startup

  Akazajan/Oraculum#580 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-09 — Detect refresh-token reuse after rotation

  Akazajan/Oraculum#579 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-08 — Revoke refresh tokens on logout

  Akazajan/Oraculum#578 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-07 — Avoid account enumeration in OTP responses

  Akazajan/Oraculum#577 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-06 — Complete login lockout lifecycle

  Akazajan/Oraculum#576 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-05 — Rate-limit OTP verification attempts

  Akazajan/Oraculum#575 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-04 — Invalidate earlier verification codes on resend

  Akazajan/Oraculum#574 · Filter by author Qoder-Voidd opened on Oct 14, 2026

• BE-03 — Recover cleanly from verification email failure

  Akazajan/Oraculum#573 · Filter by author Qoder-Voidd opened on Oct 14, 2026