cgalo5758 0b28a9dc29 Remediate security audit findings ...

- Replace gorilla/csrf with net/http CrossOriginProtection
- Require valkey-password and add TLS options for session store
- End session at /logout and revoke refresh tokens
- Re-derive identity and roles from provider every five minutes
- Process each Stripe webhook event in its own Temporal workflow
- Give each outbox entry its own workflow with Temporal retries
- Guard against stale Stripe events with provider timestamps
- Derive transport security from base-url scheme

2026-09-09 13:25:43 -05:00

..

spec.md

Remediate security audit findings

2026-09-09 13:25:43 -05:00