[fclairamb]

What changed

• AA1 (medium): a JS check now has a 64 MiB per-run memory budget on the native builtins that allocate in one call (repeat, padStart/End, join, Array(n), ArrayBuffer and typed arrays, fill, Array.from, and the length-driven sort, toSorted, map, with, toReversed, toSpliced). A refused call throws a RangeError and the worker keeps running. Spec: specs/done/2026/10/2026-10-31-01-js-checker-memory-budget.md.
• AA2 (low): turning on TOTP, registering a passkey and setting a first password now need the current password (or, without one, a sign-in within 10 minutes). 2fa/confirm requires a setupToken, and a totp-enabled notice email is sent. dash0 asks for the password first. Spec: specs/done/2026/10/2026-10-31-02-sign-in-factor-enrollment-reauth.md.

Breaking API change: 2fa/setup and passkeys/register/begin refuse a request without currentPassword on accounts with a password; 2fa/confirm needs setupToken. Sessions issued before this have no sign-in time, so passwordless accounts must sign in again once.

Known gaps (not covered): string + doubling, replaceAll, JSON.stringify and TextEncoder can still amplify; the long-term fix is process isolation of check workers (separate spec).

Earlier scan specs (implemented, in specs/done/2026/10/)

• Z1 (low): 2026-10-30-02-bug-report-authenticated-org-membership.md. Signed-in non-members skipped the bug-report screenshot budget. Fixed in fix(security): bug-report budget for non-members, retention sparing crawl reports #715.
• Z2 (low): 2026-10-30-03-report-retention-spares-crawl-reports.md. The report retention sweep also deleted website crawl reports. Fixed in fix(security): bug-report budget for non-members, retention sparing crawl reports #715.
• Y1 (low): 2026-10-29-01-bug-report-upload-instance-budget.md. Anonymous bug-report screenshots were capped per org, not per instance, and never deleted. Fixed in fix(security): instance-wide budget and retention for anonymous bug-report screenshots #708; Z1 and Z2 are follow-ups.
• X1 (high): 2026-10-28-01-pat-cannot-mint-sessions-or-sign-in-factors.md. A PAT could open sessions in its owner's other orgs and add sign-in factors. Fixed in fix(security): PAT org binding, subscribe throttle, invite lookup, SNMP secret #699.
• X2 (medium): 2026-10-28-02-status-subscribe-throttle-and-keep-confirmed.md. Unthrottled subscribe confirm emails, and re-subscribing un-confirmed a subscriber. Fixed in fix(security): PAT org binding, subscribe throttle, invite lookup, SNMP secret #699.
• X3 (medium on SaaS): 2026-10-28-03-invite-lookup-without-org-scan.md. Invite lookup scanned every org. Fixed in fix(security): PAT org binding, subscribe throttle, invite lookup, SNMP secret #699.
• X4 (low): 2026-10-28-04-snmp-community-secret-field.md. The SNMP community was not a secret field. Fixed in fix(security): PAT org binding, subscribe throttle, invite lookup, SNMP secret #699.
• V1 (medium): 2026-10-27-01-device-consent-phishing-guard.md. Device-flow consent phishing. Fixed in fix(security): device consent phishing guard and 2FA disable throttle #693.
• W1 (low): 2026-10-27-02-disable-2fa-attempt-throttle.md. DELETE /auth/2fa had no attempt budget. Fixed in fix(security): device consent phishing guard and 2FA disable throttle #693.
• U1 (low): 2026-10-26-02-ai-repair-hold-skips-param-only-secrets.md. The repair: auto hold applied only when the check's secrets map had a value. Fixed in fix(ai): hold every scheduled repair-auto run to its granted hosts #683.
• S1 (medium): 2026-10-25-01-ai-repair-grant-dropped-by-reference-resolution.md. The repair grant was compared after ${…} references were resolved. Fixed in fix(ai): hold the repair: auto host grant when the script or env holds a reference #678; U1 closed the remaining gap.
• R1 (medium): 2026-10-24-01-ai-repair-auto-apply-partial-runtime-host.md. repair: auto applied a candidate that kept a literal host and added one built at runtime. Fixed in feat(ai): hold auto-applied repairs to the previous version's hosts (+ scan specs) #663.
• Q1 (medium): 2026-10-23-02-ai-loop-secret-relay-through-model.md. AI loops relayed an encoded secret through the model.
• P1 (medium): 2026-10-22-01-ai-script-secret-host-guard-runtime.md. AI runs with real secrets were only host-checked by regex.
• K1 (medium): 2026-10-20-01-sender-response-body-caps.md. Notification senders and RabbitMQ read responses uncapped.
• J1 (medium): 2026-10-19-01-a2a-response-size-cap.md. A2A responses were read uncapped.
• I1 (low): 2026-10-18-01-plugin-schema-file-ref.md. Plugin schema $ref could load local files.
• G1/G2 (low): 2026-10-17-01-postgres-check-connection-config.md. Postgres conninfo escaping and fallback to the worker's PG* env.
• F1: 2026-10-16-15-pat-cache-revocation.md. The PAT cache outlived revocation.
• E1: 2026-10-16-14-totp-on-federated-sign-in.md. No TOTP on federated sign-in.
• E2: 2026-10-16-13-atomic-auth-attempt-counters.md. Auth attempt counters were not atomic.
• H3: 2026-10-16-12-mcp-tokens-rejected-on-rest.md. MCP OAuth tokens worked on REST.
• H2: 2026-10-16-11-slack-signature-fail-closed.md. Slack signature check failed open.
• T1 / M2 (high): 2026-10-16-10-discovery-scans-egress-guard.md. Discovery scans were outside the egress policy.
• N4: 2026-10-16-09-js-check-nested-docker-guard.md. A JS docker sub-check bypassed the gate.
• N3 (high): 2026-10-16-08-status-page-components-cross-org.md. Status-page components could be edited across orgs.
• D2/D3 (high): 2026-10-16-07-guard-status-subscriber-and-publication-webhooks.md. Subscriber and publication webhooks were not guarded.
• C3: 2026-10-16-06-accept-invite-existing-account.md. Accepting an invite logged in as an existing account.
• C1: 2026-10-16-05-kubeconfig-exec-and-incluster.md. Kubeconfig exec and inCluster were allowed.
• N2: 2026-10-16-04-mysql-dsn-injection.md. MySQL DSN injection.
• N1: 2026-10-16-03-env-secret-reference-allowlist.md. No allowlist for ${env:} references.
• C2/H1: 2026-10-16-02-token-purpose-separation.md. Purpose tokens were accepted as access tokens.
• D1: 2026-10-16-01-microsoft-signin-unverified-email-linking.md. Microsoft nOAuth email linking.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 91.76201% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.77%. Comparing base (b2eb48f) to head (58e6b60).

Files with missing lines	Patch %	Lines
server/internal/checkers/checkjs/memory.go	90.51%	26 Missing ⚠️
server/internal/handlers/auth/factor_reauth.go	89.41%	9 Missing ⚠️
server/internal/handlers/auth/service.go	97.77%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #728      +/-   ##
==========================================
+ Coverage   89.76%   89.77%   +0.01%     
==========================================
  Files        1304     1306       +2     
  Lines      132584   132987     +403     
==========================================
+ Hits       119018   119394     +376     
- Misses      13557    13584      +27     
  Partials        9        9              

Files with missing lines	Coverage Δ
server/internal/checkers/checkjs/checker.go	91.83% <100.00%> (+0.01%)	⬆️
server/internal/email/supportreply.go	92.68% <ø> (ø)
server/internal/handlers/auth/email_change.go	89.78% <100.00%> (+0.59%)	⬆️
server/internal/handlers/auth/handler.go	90.57% <100.00%> (+0.14%)	⬆️
server/internal/handlers/auth/join_policy.go	88.08% <100.00%> (ø)
server/internal/handlers/auth/org_profile.go	87.85% <100.00%> (+0.17%)	⬆️
server/internal/handlers/auth/passkey_handler.go	94.69% <100.00%> (+0.35%)	⬆️
server/internal/handlers/auth/passkey_service.go	87.05% <100.00%> (+0.09%)	⬆️
server/internal/handlers/base/base.go	96.49% <ø> (ø)
server/internal/handlers/emailpreview/fixtures.go	100.00% <ø> (ø)
... and 4 more

... and 18 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.