taigrrRefuse writes and payments from accounts without a verified email (AUTH-B1): one shared guard gates limitWrite, every non-self-service REST route, MCP write tools, git and LFS pushes, release uploads, OAuth consent and Stripe checkout, while profile, email, password, 2FA, stars, follows and deletion stay open. The password-reset handover now also strips grants, agents, webhooks, secondary emails and invitations, and the web app shows a verify banner and hides write CTAs.
70b0ad2 ·
- ..
- api.ts
- blob-read.ts
- container-admin.ts
- container-api.ts
- container-authz.ts
- container-config.ts
- container-do.ts
- container-meter.test.ts
- container-meter.ts
- host.ts
- http.ts
- origin-check.test.ts
- origin-check.ts
- origin.ts
- preview-headers.test.ts
- preview-headers.ts
- raw.d.ts
- room-agents.ts
- room-api.ts
- room-awareness.ts
- room-client.ts
- room-files.ts
- room-presence.ts
- room-send.ts
- room-throttle.test.ts
- room-throttle.ts
- room.ts
- session.ts
- workbench-boot.js
- workbench.ts
- write-guard.ts