With the Security section closed out, it felt like the right moment for another full pass, covering Access Control, Password Policy, API Tokens, the Service Configuration section, and the Accounts batch. Two of the findings were real, not theoretical.
The bigger one: WebDAV’s directory scoping was validated only when a credential was created, rather than holding up if the filesystem changed afterward. It was closed with the standard safeguard for that class of issue, and a test now proves every generated configuration carries it.
The other: broadcast messages to account owners were meant to be queued as background jobs, but a missing interface meant they ran inline during the admin’s request. On a large account list that could time out partway through. Fixed and guarded with a test that checks queueing directly.
Three smaller items were closed alongside those: an information-disclosure detail in a bulk-removal response, a couple of settings that weren’t independently re-checked on the privileged side like their siblings, and rate limiting on the new API surface. All narrow, all closed the same day, none requiring customer action.
One more item wasn’t a security issue but was worth fixing: the automated test workflow had been failing on two small style violations that local checks, which only covered changed files, never caught. A full pass over the whole repository found and fixed both.
Everything else checked out clean: the new firewall allow-lists, the central password policy, and every ability check on the scoped API tokens, confirmed with real tokens on a development server. Git history came back clean. All servers were checked directly, code, version, and running state matching what was deployed, with test suites green.