hardening

Full-stack security — API audit, auth audit, postmortem, triage

Full-stack security — API audit, auth audit, postmortem, triage