taigrrRefuse writes and payments from accounts without a verified email (AUTH-B1): one shared guard gates limitWrite, every non-self-service REST route, MCP write tools, git and LFS pushes, release uploads, OAuth consent and Stripe checkout, while profile, email, password, 2FA, stars, follows and deletion stay open. The password-reset handover now also strips grants, agents, webhooks, secondary emails and invitations, and the web app shows a verify banner and hides write CTAs.
70b0ad2 ·
- ..
- tools
- agents.ts
- audit.ts
- caller.ts
- coordination.test.ts
- coordination.ts
- cron.ts
- dispatch.ts
- event-access.ts
- events.ts
- grants.ts
- hub-do.test.ts
- hub-do.ts
- hub-session.ts
- issue-writes.ts
- listen.ts
- oauth-clients.test.ts
- oauth-clients.ts
- oauth-consent.ts
- oauth.ts
- prompts.ts
- protocol.ts
- resources.ts
- routes.ts
- scopes.ts
- transport.ts
- untrusted.test.ts
- untrusted.ts
- usage.ts