Add Security Review
to your pull requests.

P1Blocked-email list is matched case-sensitively — trivially bypassed at signup · Security Review

When an admin blocks an email, a blocked spammer re-registers with different letter case ('BAD@spamclub.com') and the account is created: should_block? does a case-sensitive where(email:) and the signup path never downcases the submitted email, so the new control fails its one job.

P2Single-use guarantee of backup codes is not concurrency-safe (TOCTOU) · Security Review

When two login requests supply the same backup code concurrently, both read the stored array before either write lands, so both pass indexOf and both log in. This breaks the UI promise in the new locale string backup_code_instructions: 'Each backup code can be used exactly once'. Trigger: parallel signIn calls with the same code (e.g. double-clicked submit).

P1Local cache is set before CreateOrUpdateDevice, so a limit-rejected device is silently whitelisted for 29 minutes · Security Review

When the device limit is reached, tagDeviceUI caches the device key before CreateOrUpdateDevice returns ErrDeviceLimitReached; the failed request errors for the anonymous user (client.go:46), but the next request from the same device hits the cache, returns nil, and proceeds untagged — one failed load then a limit bypass per node per 29min.