From 49e1ab473070862aad99ec9ec0ba45d91a89f693 Mon Sep 17 00:00:00 2001
From: Zaki <18zaki18@gmail.com>
Date: Sat, 9 May 2026 22:29:09 +0100
Subject: [PATCH] Mark resolved issues in security-issues.md

---
 security-issues.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/security-issues.md b/security-issues.md
index d6bc218..1245973 100644
--- a/security-issues.md
+++ b/security-issues.md
@@ -1,8 +1,8 @@
 # Remaining Security Issues
 
-1. **No rate limiting on `/reauth`** — brute-force possible via export dialog
-2. **No Content Security Policy (CSP)** header — XSS could leak crypto key from sessionStorage
+1. ~~**No rate limiting on `/reauth`** — brute-force possible via export dialog~~ ✅
+2. ~~**No Content Security Policy (CSP)** header — XSS could leak crypto key from sessionStorage~~ ✅
 3. **Crypto key in sessionStorage (extractable)** — necessary for refresh persistence, but XSS can steal it. HttpOnly cookie + service worker is more secure but complex
-4. **No session rotation** — same token until logout; if leaked, valid for 24h
+4. ~~**No session rotation** — same token until logout; if leaked, valid for 24h~~ ✅
 5. **No 2FA** — opted out of TOTP implementation
-6. **Password generator modulo bias** — `c.charAt(arr[i] % c.length)` has slight bias when c.length does not divide 2^32; not practically exploitable
+6. ~~**Password generator modulo bias** — `c.charAt(arr[i] % c.length)` has slight bias when c.length does not divide 2^32; not practically exploitable~~ ✅