taigrrRefuse writes and payments from accounts without a verified email (AUTH-B1): one shared guard gates limitWrite, every non-self-service REST route, MCP write tools, git and LFS pushes, release uploads, OAuth consent and Stripe checkout, while profile, email, password, 2FA, stars, follows and deletion stay open. The password-reset handover now also strips grants, agents, webhooks, secondary emails and invitations, and the web app shows a verify banner and hides write CTAs.
70b0ad2 ·
- ..
- advisories.ts
- api.ts
- code-scanning.ts
- commit-signature.ts
- dependencies.ts
- detectors.test.ts
- detectors.ts
- manifests-json.ts
- manifests-text.test.ts
- manifests-text.ts
- manifests.ts
- openpgp-keys.ts
- openpgp.ts
- policy.ts
- push-protection.test.ts
- push-protection.ts
- queue.ts
- sarif.test.ts
- sarif.ts
- secret-alerts.ts
- secret-scan.ts
- settings.ts
- signatures.ts
- sshsig.ts