- Signed-out visitors get the same login redirect for missing and
private projects, so the redirect no longer reveals private ones.
- Production refuses the console email backend; sign-in codes must
never reach the logs.
- Database cache shared by all workers for allauth rate limits; invite
sending throttled per sender and per recipient.
- Email invite links are claimed on first use and the token rotated,
so a token copied from request logs is worthless.
- allauth password URLs removed; adding an email requires a fresh code
and notifies existing addresses.
- Markdown drops remote images until uploads exist.
- Project and org slugs lowercased; only superusers can grant staff
status or permissions in the admin.
- Container runs as a non-root user; CI actions pinned to commits.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Sign-in via django-allauth: emailed one-time codes, GitHub, Discord,
and Forgejo instances as OpenID Connect apps registered in admin.
Regular users never have a password; sysadmins sign in only at
/admin/ and are redirected there from the normal sign-in.
Organizations at the URL root with owner and collaborator roles, a
per-member project-create grant, and invites by username or email.
Email invites carry a bearer token stored only as a hash. The last
owner can't leave, be removed or be demoted. Permission checks live
in intent/access.py.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
