Marc-André Bombeck 36c899b1c8 docs(security): note that required-MFA prompts but does not wall the API ...

The "Require a second factor" policy redirects web users to enrollment but does
not block direct API or native (Bearer) access for an account that has not yet
enrolled — a deliberate lockout-safety choice. Make that explicit: spell it out
in the admin toggle description, add a code comment at the toggle, and add an
operator runbook (docs/ops/mfa-enforcement.md) describing the boundary.

2026-06-27 22:23:54 +02:00

..

migrations

feat(v1.4): multi-tenant prep — off-host backup, encryption-key versioning, worker/web split, native-Bearer UA gating (#135)

2026-05-08 14:33:39 +02:00

attempt-number-semantics.md

chore(release): v1.4.49 — audit-backlog closure + server reminder suppression + diagnostic endpoint + analytics cold-path fix

2026-05-23 12:51:41 +02:00

backup-restore.md

chore(ops): signed images, a secret gate before commit, and a monthly restore drill

2026-06-11 00:10:01 +02:00

deploy.md

fix(api,ops): transactional adopt, admin gate without a flash, and a digest path to deploys

2026-06-11 11:45:58 +02:00

encryption-key-rotation.md

feat(v1.4): multi-tenant prep — off-host backup, encryption-key versioning, worker/web split, native-Bearer UA gating (#135)

2026-05-08 14:33:39 +02:00

env-check.md

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

intake-repair.md

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

mfa-enforcement.md

docs(security): note that required-MFA prompts but does not wall the API

2026-06-27 22:23:54 +02:00

password-reset.md

feat(insights): cycle ring replaces strain tile, tidy overview spacing, nav order, password-reset CLI

2026-06-06 21:31:12 +02:00

tls-cert-pin.md

feat(ops): alarm on a TLS leaf SPKI change for pinned native clients

2026-06-05 08:10:13 +02:00

v141-followup-issues.md

docs: scrub PII + internal jargon + German leaks from user-facing artifacts

2026-05-10 15:14:28 +02:00