taigrrRefuse writes and payments from accounts without a verified email (AUTH-B1): one shared guard gates limitWrite, every non-self-service REST route, MCP write tools, git and LFS pushes, release uploads, OAuth consent and Stripe checkout, while profile, email, password, 2FA, stars, follows and deletion stay open. The password-reset handover now also strips grants, agents, webhooks, secondary emails and invitations, and the web app shows a verify banner and hides write CTAs.
70b0ad2 ·
- ..
- actions
- badge.ts
- builtin-actions.ts
- cache-api.test.ts
- cache-api.ts
- compile.ts
- config-admin.ts
- config-values.ts
- cron.ts
- deployment-settle.test.ts
- deployments.ts
- dispatch-quota.test.ts
- dispatch.ts
- event-triggers.ts
- expressions.ts
- http.ts
- job-api-gateway.ts
- job-cancel.test.ts
- job-doorbell-do.ts
- job-doorbell.test.ts
- job-doorbell.ts
- job-hold.test.ts
- job-hold.ts
- job-masks.test.ts
- job-masks.ts
- job-token-disabled.test.ts
- job-token.ts
- jobs.ts
- log-stream.ts
- maintenance.ts
- markers.ts
- matrix.ts
- oidc.ts
- permissions.ts
- recompile.ts
- rerun.ts
- run-control.ts
- run-insert.ts
- run-workflow.ts
- runner-api.ts
- runner-claim.ts
- runner-do.ts
- runner-meta.ts
- runner-owner.ts
- runner-policy.ts
- runner-registration.ts
- runner-sizes.ts
- runner-variants.ts
- scheduler.ts
- script-runtime.ts
- script.ts
- segments.ts
- spec.ts
- triggers.ts
- usage-hooks.ts
- workflow-index.ts