COR-1549: decide vuln-api token-send by endpoint trust, not by whether it is the default - #135

Merged

juangaitanv merged 5 commits into

mainfrom

Jul 30, 2026

Commits on Jul 28, 2026

COR-1549: require opt-in before sending tokens to a non-production vuln-api default
Test
committed
COR-1549: correct in-repo docs that promised fail-closed after login
Test
committed
COR-1549: disclose public mode when a token is withheld
Test
committed
COR-1549: make the tokenless hint conditional, cover disclosure end to end
Test
committed

Commits on Jul 29, 2026

COR-1549: the default vuln-api is production; mark it trusted
Test
committed