Age	Commit message (Expand)	Author	Lines
20 hours	Drive the auth actions through the harness	Bryce Kwon	-14/+2
21 hours	Hold signatures to the length SHA-256 gives	Bryce Kwon	-0/+3
21 hours	Check a session cookie scoped below the root	Bryce Kwon	-0/+9
21 hours	Check expired and planted sessions on a visit	Bryce Kwon	-0/+7
21 hours	Check the form is there where a message is not	Bryce Kwon	-1/+4
21 hours	Check a login when crypt cannot check the hash	Bryce Kwon	-1/+12
21 hours	Give the outsider account a hash of its own	Bryce Kwon	-5/+10
21 hours	Check a failure flag that follows a question mark	Bryce Kwon	-0/+5
21 hours	Check every failed login answers and logs alike	Bryce Kwon	-3/+27
21 hours	Check each auth library missing on its own	Bryce Kwon	-5/+44
21 hours	Make the cookie timing check hold on fast cores	Bryce Kwon	-5/+9
21 hours	Sign the malformed cookies the checks refuse	Bryce Kwon	-3/+3
21 hours	Check how auth groups resolve to members	Bryce Kwon	-8/+16
21 hours	Accept only a local path as the way back in	Bryce Kwon	-0/+10
21 hours	Run the auth checks against the real libraries	Bryce Kwon	-16/+26
21 hours	Check the login form's field names	Bryce Kwon	-0/+4
22 hours	Check the auth files that are missing or broken	Bryce Kwon	-0/+21
22 hours	Check the comparisons that must not leak timing	Bryce Kwon	-0/+25
22 hours	Check when a session expires	Bryce Kwon	-0/+26
22 hours	Check that a signature covers every cookie field	Bryce Kwon	-0/+20
22 hours	Check that the secret keys every signature	Bryce Kwon	-0/+12
22 hours	Check that the auth secret is made safely	Bryce Kwon	-8/+82
22 hours	Give each auth unit run a directory of its own	Bryce Kwon	-16/+18
3 days	Read the login form table as layout	Bryce Kwon	-0/+1
6 days	Log failed logins	Bryce Kwon	-0/+7
6 days	Say that logging in needs https	Bryce Kwon	-1/+12
6 days	Tell a signed-in visitor they have no access	Bryce Kwon	-0/+7
6 days	Say when logins are unavailable	Bryce Kwon	-1/+16
9 days	Write a session's expiry in whole seconds	Bryce Kwon	-0/+11
9 days	Share the request helpers in the auth checks	Bryce Kwon	-77/+49
9 days	Drop auth guards for input cgit never sends	Bryce Kwon	-3/+4
9 days	Strip control characters from the location alone	Bryce Kwon	-2/+0
9 days	Take a signed cookie apart with one match	Bryce Kwon	-0/+1
2026-10-24	Say when a login fails, and line up the form	Bryce Kwon	-1/+11
2026-10-05	Name the auth cookie __Host- where it can be	Bryce Kwon	-26/+51
2026-10-05	End a session when its account's hash changes	Bryce Kwon	-4/+20
2026-10-04	Load auth libraries only when a request needs one	Bryce Kwon	-0/+13
2026-10-04	Spend a missing account's login on a real hash	Bryce Kwon	-36/+51
2026-10-04	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-0/+22
2026-10-04	Read the auth cookie in linear time	Bryce Kwon	-0/+10
2026-09-28	Refuse every repository when auth-file loses repos	Bryce Kwon	-0/+13
2026-09-07	Clean up the whole tree	Bryce Kwon	-62/+31
2026-09-04	Add a test suite for the shipped extensions	Bryce Kwon	-0/+302