Moheeb Zara 92170e44f4 fix(auth): validate /auth/callback next param against open-redirect (D3) ...

next was appended to origin unvalidated; next=//evil.com or /\evil.com
redirected off-site post-login. Now only a same-origin absolute path
(single leading slash, no //, no /\) is honored, else /dashboard.

2026-05-18 18:31:06 -07:00

..

callback

fix(auth): validate /auth/callback next param against open-redirect (D3)

2026-05-18 18:31:06 -07:00

confirm

fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

2026-05-18 17:01:25 -07:00