All pull requests

Pull requests

• Record each redeemed authorization code, so one can't mint again once its grant is gone

  #3206·jeremy opened Oct 17, 2026Member·

  ·
  11

• Issue personal access tokens from a first-party client, and backfill existing ones onto it

  #3205·jeremy opened Oct 17, 2026Member·

  ·
  44

• Report OAuth audit events and export OAuth metrics

  #3204·jeremy opened Oct 17, 2026Member·

  ·
  47

• Drop the plaintext personal access token column (D3 of 3: drop identity_access_tokens.token)

  #3203·jeremy opened Oct 17, 2026Member·

  ·
  40

• Store personal access tokens only as digests (D2 of 3: rerun the backfill, stop the plaintext)

  #3202·jeremy opened Oct 17, 2026Member·

  ·
  26

• Keep sign-in codes, API tokens and join codes out of logged SQL

  #3201·jeremy opened Oct 17, 2026Member·

  ·
  7

• Bump thruster from 0.1.26 to 0.1.27

  dependenciesruby
  #3199·dependabot[bot] opened Oct 16, 2026Bot·

  ·
  1

• Bump aws-sdk-s3 from 1.232.1 to 1.233.2

  dependenciesruby
  #3198·dependabot[bot] opened Oct 16, 2026Bot·

  ·
  1

• Bump selenium-webdriver from 4.50.0 to 4.51.0 in the development-dependencies group

  dependenciesruby
  #3197·dependabot[bot] opened Oct 16, 2026Bot·

  ·
  1

• Bump ruby/setup-ruby from 1.327.0 to 1.328.0 in the github-actions group

  dependenciesgithub_actions
  #3196·dependabot[bot] opened Oct 16, 2026Bot·

  ·
  1

• Record where Fizzy stands against our OAuth rubric

  #3193·jeremy opened Oct 15, 2026Member·

  ·
  27

• Store tokens and client secrets as digests (D1 of 3: read by digest, plaintext fallback)

  #3192·jeremy opened Oct 15, 2026Member·

  ·
  37

• Pin today's token and session authentication for shipped clients

  #3191·jeremy opened Oct 15, 2026Member·

  ·
  3

• Bump rails from 4658033 to 48dc419

  dependenciesruby
  #3182·dependabot[bot] opened Oct 9, 2026Bot·

  ·
  2

• Publish to fizzy-edge; v* releases are promoted by basecamp/release-images

  #3173·jeremy opened Oct 8, 2026Member·

  ·
  7

• Fix comment Post button staying disabled after pasting

  #3172·piotrsynowiec opened Oct 7, 2026·

  ·
  1

• Preserve board columns and scroll when returning from a card

  #3171·piotrsynowiec opened Oct 7, 2026·

  ·

• Add previous and next card navigation within columns

  #3170·piotrsynowiec opened Oct 7, 2026·

  ·
  2

• End an app's own plumbing with its grant; keep what it set up for the account

  #3169·jeremy opened Oct 7, 2026Member·

  ·
  57

• Add support for single sign-on (SSO) through OIDC IdP

  #3167·gjazali opened Oct 6, 2026·

  ·
  22

• Prefix newly issued access tokens, refresh tokens and personal access tokens

  #3163·jeremy opened Oct 6, 2026Member·

  ·
  24

• Lapse OAuth grants left idle for 90 days

  #3161·jeremy opened Oct 6, 2026Member·

  ·
  48

• Revoke the grant when a rotated refresh token is replayed, with a 60s retry grace

  #3160·jeremy opened Oct 6, 2026Member·

  ·
  50

• Sweep self-registered OAuth clients left without a grant for 30 days

  #3159·jeremy opened Oct 6, 2026Member·

  ·
  61

• Answer API authentication failures with a Bearer challenge

  #3158·jeremy opened Oct 6, 2026Member·

  ·
  14