Nick SzaunigandClaude Opus 5.5 0ba8996e3a feat(auth): 12-character minimum, 72-byte maximum and breach check for new passwords ...

- New passwords (create user, admin reset, own change) need at least 12
  characters (ASVS 2.1.1) and may not exceed 72 bytes, which bcrypt would
  silently cut off.
- They are checked against Have I Been Pwned with k-anonymity (only the
  first 5 SHA-1 characters leave the server, padded responses); an
  unreachable service is logged and does not block. PASSWORD_BREACH_CHECK
  =false disables it for offline deployments.
- Login accepts existing passwords as before, capped at 256 characters to
  bound anonymous bcrypt work.
- Password fields in the UI say the rule up front.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-01 02:47:09 +02:00

.gitea/workflows

Env Update

2026-08-27 08:32:47 +02:00

ApiCore-Backend

feat(auth): 12-character minimum, 72-byte maximum and breach check for new passwords

2026-10-01 02:47:09 +02:00

ApiCore-Frontend

feat(auth): 12-character minimum, 72-byte maximum and breach check for new passwords

2026-10-01 02:47:09 +02:00

deploy/k8s

fix(backup): seal backups and require step-up auth to restore

2026-10-01 02:12:43 +02:00

docs

feat: Ein-/Auswinterung und Winterverluste je Volk

2026-09-28 17:32:03 +02:00

ARCHITECTURE.md

feat: Ein-/Auswinterung und Winterverluste je Volk

2026-09-28 17:32:03 +02:00

CLAUDE.md

Env Update

2026-08-27 08:32:47 +02:00

TASKS.md

docs: record review findings, verification state and new architecture decisions

2026-09-27 13:01:47 +02:00

S

Description

ApiCore - Imkereidokumentationssoftware

https://apicore.encry.de/

7.6 MiB

0 Stars 1 Watchers 0 Forks

Languages

TypeScript 98.5%

JavaScript 0.8%

Python 0.3%

CSS 0.2%

PLpgSQL 0.1%