fix(security): bind invite acceptance to invited identity - #593

Draft

seonghobae wants to merge 22 commits into

fix/invite-identity-binding-592

Commits on Aug 23, 2026

test(security): reproduce invite identity takeover
seonghobae
committed
6e0c49f
test(security): register invite identity regression
seonghobae
committed
80b2682
fix(security): bind invite redemption to identity
seonghobae
committed
58c5c30

Commits on Aug 25, 2026

Commits on Aug 28, 2026

test: redact secret path variants from request logs
seonghobae
committed
8981c8d
fix: redact bearer tokens on malformed paths
seonghobae
committed
a7bc39d

Commits on Aug 29, 2026

fix(security): preserve Unicode invite identities
seonghobae
committed
f8baae8
fix(security): canonicalize Unicode invite identities
seonghobae
committed
2ce9f1d
test(coverage): require invite identity instrumentation
seonghobae
committed
11493bb
fix(coverage): instrument invite identity module
seonghobae
committed
c0c4cb2
fix(invites): use complete Unicode mailbox folding
seonghobae
committed
27e581a
test(invites): close current-head coverage gaps
seonghobae
committed
d3937e7
test(invites): reject invitations for unregistered identities
seonghobae
committed
4850e56
fix(invites): bind invitations to registered accounts
seonghobae
committed
0a9d7c0
docs(api): document account-bound invitation contract
seonghobae
committed
1ece078
test(api): register invitee in smoke fixture
seonghobae
committed
c98304e
test(api): preserve revoked invite identity
seonghobae
committed
1aec93d
fix(identity): preserve Cherokee case folding
seonghobae
committed
6afb53e