Repository navigation
feat: add certificate pinning, biometric step-up, device binding, and CI secret scanning (#1764-#1767) - #1826
Merged
Smartdevs17 merged 1 commit intoOct 17, 2026
Conversation
… CI secret scanning (Smartdevs17#1764-Smartdevs17#1767) - Certificate pinning (Smartdevs17#1764): add certificatePinning service with config/env-driven pins/modes (enforce/report/disabled), hostname matching, SPKI validation, rotation support; integrate verifyCertificate() into apiClient (HTTPS-only, span attributes); add tests (24 passing); docs/CERTIFICATE_PINNING.md. - Biometric step-up (Smartdevs17#1765): add sensitiveActionGuard with persisted policy (default enforces transfer_funds/export_private_key/confirm_payment/delete_account), fallback onUnavailable, BiometricGateError; wire into SubscriptionDetailScreen (transfer_funds) and PrivacyCenterScreen (delete_account); add tests (10 passing). - Device binding (Smartdevs17#1766): add DeviceBindingMode to serverSessionService (default enforce), device_mismatch reason, binding check in validateSession, rebindSession with step-up guard (reauthenticated only) and audit 'rebound'; add POST /sessions/rebind requiring X-Session-Token + recent passkey X-Reauth-Token; add tests (16 passing). - Secret scanning (Smartdevs17#1767): update .gitleaks.toml with allowlist/stopwords, fix security-scan workflow to --exit-code=1 and --log-opts=--all; local full-history scan clean; docs/SECRET_SCANNING.md. - Add docs: BIOMETRIC_STEP_UP.md, SESSION_DEVICE_BINDING.md. Tests: 50/50 pass; no new TS/lint errors introduced (typecheck 517 errors unchanged). Skip pre-commit hooks per user instruction to push immediately.
|
@LamsOfJos Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1764
Closes #1765
Closes #1766
Closes #1767