3 commits

Author	SHA1	Message	Date
Adam Moussa	2a7d8af1f7	chore(security): suppress public OAuth fixture ... Document the scanner false positive without suppressing any runtime credential flow.	2026-07-31 11:53:53 -04:00
Adam Moussa	347b84f964	fix(auth): require Google authentication in cloud mode ... Remove the public shared-key mechanism and fail closed on Google auth while adding submit-route throttling.	2026-07-31 11:24:57 -04:00
Adam Moussa	e2d1b2fce8	chore(security): add repo-local suppression for test-fixture FP (gitleaks-45) (#48) ... Moves the false-positive suppression for tests/test_submit_order.py:45 (a dummy test API key, proof-or-kill verified 2026-07-13) from machine-level to a tracked repo-local .security-review/suppressions.json so the Open SWE daily-report automation — which cannot see ~/.config on the Mac — resolves it. Machine-level copy retained until this merges.	2026-07-13 14:30:43 -04:00