Mission Run Overview
Mission Run: Auth token-target issuer guard
Stop the CLI from POSTing refresh/access tokens to the wrong server.
A P0 credential-exposure fix: four token-bearing auth flows (refresh, logout/revoke, membership rehydrate, websocket token provisioning) currently ignore the configured server and the session's own issuer, so self-hosted users leak tokens to the public host and a hostile checkout can exfiltrate a refresh token. This mission routes every token-bearing call to the session's issuer, refuses on mismatch, and fences the unsafe accessor so the class cannot recur.
Total Tasks
5
0 planned
In Progress
0
Review
0
Approved
0
Completed
5
100% done