2 Commits

Author	SHA1	Message	Date
admin	e221476ff5	R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain) ... A sibling subdomain can no longer toss a session cookie the hub reads first. Operators are logged out once; plain-HTTP browser login no longer holds a session; Basic auth for scripts is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 21:45:04 +02:00
admin	3d7a2761fc	hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 11:12:56 +02:00