- Shipped
- November 15, 2026 at 12:45 AM UTC
- Author
- Kamo
- Commit
- aa510ff
- Remove the WireGuard configs (wg0-k0m1/k1m1/k2m1.conf), wazuh_config.xml, run.bat, the two zero-byte console.log(... files and the partner PDFs/DOCX from the tree, and ignore them. The WireGuard private keys stay in git history and must be rotated (ID0.6, owner). - Delete /valid (rendered every cookie, *** included), the dead /validate (posted to an /api/validate that does not exist), /api/user-token, /api/user-info, /api/resend-verification, KToken.ts, _app.js and the unused invoice components. Nothing imports any of them. - Sign-in no longer logs the username (client or server), document.cookie, the remembered username, the full /api/login answer or the redirect URL, both of which carry the one-time key.