- /auth/register: strip client-supplied seed flag (PoC confirmed it bypassed
invite code, MAX_USERS quota AND first-user auto-admin, granting admin
without any credential); demo-rebuild internal path unaffected
- /auth/login: per-IP+username of 5 consecutive failures gets a 10-minute
cooldown against in-memory counter (brute-force guard)
- /auth/logout: new endpoint revokes the current Bearer token server-side;
frontend calls it (best-effort) before local clearToken on sidebar logout
- attachment docx/xlsx preview: sanitize generated HTML (strip scripts,
event handlers, dangerous protocols) before dangerouslySetInnerHTML
render, preventing token theft via malicious previewed documents
PoC suite: seed smuggling rejected, 429 on 6th login attempt, token dead
after logout, per-user isolation intact (403/401/404 as before);
integration 61/61 green
root
17ab5f0390