Block a user
SDK client metadata is silently rewritten on reconnect
User-agent signing endpoint accepts arbitrary client_id
Encrypted key material not bound to wallet address — cross-wallet signing possible
Consumed bootstrap token is not zeroized in memory
security: batch of fixes
Wallet-access revocation deletes by wallet_id instead of entry id
Integrity envelopes do not survive root key rotation
Bootstrap token RNG seeding should be made explicit
deps(server): version bump
RequestTracker allows arbitrary gaps across request flows
fix(user-agent): zombie sessions #74