Skip to content

docs(decisions): raise D-064 (sign-in lock) and D-065 (audit address hash) (#879) - #887

Merged
alex-dembele merged 1 commit into
masterfrom
879-decisions-login-lock
Oct 2, 2026
Merged

alex-dembele merged 1 commit into
masterfrom
879-decisions-login-lock

Conversation

@alex-dembele

Copy link
Copy Markdown
Member

Refs #879. This doesn't close it: the issue stays open until the owner decides.

Records two open owner decisions in docs/DECISIONS.md, both raised by #688 and both touching the auth/crypto design that CLAUDE.md reserves to the owner:

  • D-064 — Sign-in lock: anyone can keep an address locked by re-triggering the 15-minute lock. Options: keep it / trusted-device cookie / progressive delay / CAPTCHA. Recommendation: trusted-device cookie (OWASP).
  • D-065 — Audit address hash: unsalted SHA-256 can be reversed against a list of addresses. Options: keep it / HMAC with a dedicated server key / no address in the audit trail. Recommendation: HMAC with a dedicated key.

No code. /decide clears them.

Verification

  • Docs only. ## Open was empty and now holds D-064 and D-065, the next free numbers after D-063.

…hash) (#879)

Signed-off-by: alex-dembele <alexandredembele16@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant