Security

Audience binding was a no-op. Resource servers accepted any aud starting with a client id, so a token minted for one client could be replayed against another resource. Now: exact resource-URL match, enforced on both ends.

Unverified account squatting. Registering someone else's email created account state the real owner later inherited — with the squatter's passkey still attached. Now: verify-first registration; the inbox is proven before any account exists, and reclaiming a previously-unverified row deletes prior credentials and revokes sessions.

Existing accounts accepted new passkeys from just an email. Typing a victim's address bound the attacker's passkey to their account. Now: a 6-digit approval code gates every added credential.

OTP caps did not bind under concurrency (KV read-modify-write). Now: codes live in D1 and the attempt is counted by the same statement that enforces the ceiling.

The consent endpoint skipped the email-verified gate that the UI path enforced. Now: 403 on unverified, on every path.

Dev mode and test harnesses were live in production — a shared origin that dissolved per-subdomain passkey isolation, and endpoints that could mint sessions. Now: both off; harnesses 404 in production.

Refresh tokens had rotation but no reuse detection. Now: token families — replaying a rotated-out token revokes the whole chain; 30-day absolute lifetime; RFC 7009 revocation; "sign out everywhere" revokes families (a plain browser sign-out deliberately does not — it must not disconnect a user's MCP connectors). Users also see their connected apps on their sign-in server and can revoke any one on its own, and are emailed the first time a connection is renewed from a network it has not used before.

Account-existence oracle — registration answered differently for known and unknown emails. Now: identical responses either way.

Tenant signing keys sat in plaintext rows. Now: AES-GCM wrapped under a separate key-wrap secret; a database read alone can no longer forge tokens.

resource and scope were attacker-controlled strings baked into signed tokens. Now: validated URL shape, owner allowlists, scope intersection.

The consent screen showed only the client's self-chosen name — ideal phishing. Now: it names the redirect host, the resource, the scopes, and flags brand-new clients.

Open client registration was invisible to app owners. Now: a per-app registration policy (open / allowlist / off), a client list with provenance, and revocation that actually kills the client's outstanding tokens.

Customer-controlled names flowed unescaped into emails (phishing on our sending reputation, header injection). Now: escaped, stripped, validated at creation.

Racy KV rate counters. Now: atomic D1 counters for every security-relevant cap, keyed per tenant and IP.

CSRF rested on SameSite alone, which does not separate sibling subdomains. Now: Origin validated on state-changing POSTs.

Missing OAuth hardening — no RFC 9207 iss, loose response_type/PKCE-length/token-endpoint validation. Now: all enforced.

Reserved-slug gaps including demo and security-sounding names usable for phishing. Now: list extended.

Unanchored session-cookie regex — a fixation primitive. Now: anchored.

Re-enrolling a device 500'd (missing excludeCredentials); UV policy hardcoded; error responses leaked internals; admin secret compared non-constant-time. Now: all fixed; user-verification is a per-app setting.

Schema drift — a rebuild from schema.sql would have dropped the verification column. Now: realigned, migrations recorded.