Repository navigation
Epic: v0.20 never locked out, and hardened #386
Description
Goal
The main fear about going passwordless is losing access. Make lockout recoverable for users and impossible for admins, and harden every public repo after the 2026-10-21 review so the platform holds up to someone reading the source looking for a way in.
Tracks
Never locked out: recovery codes (#398, seamless-auth-react#185), self-service recovery with a delay (#399), passkey management (seamless-auth-react#186), break-glass admin (#401), staged policy changes with rollback and dry runs (#402, #403, seamless-auth-admin-dashboard#295), guide (seamless-auth-docs#113).
Admin and secrets: step-up on config, role and deletion writes (#437, seamless-cli#245), each secret required with no service token fallback (#447, seamless-cli#295), removal of OAUTH_ALLOW_UNBOUND_STATE (#476), admin identity changes revoke and notify (#475).
API hardening: #468 #469 #470 #471 #472 #473 #474.
Adapter and SDK hardening: seamless-auth-server#225-#230, seamless-auth-go#10 #11, seamless-auth-python#12, seamless-auth-rust#11, seamless-auth-react#198 #199 #204 #205 #206.
Scaffolding: seamless-cli#296 #302 #303 #304 #305 #306, seamless-templates#132 #133 #134.
Docs and website: seamless-auth-docs#134 #135, seamless-website#27-#30.
A security patch (0.19.x) ships before the v0.20 releases; its advisories and their follow-up issues are published with it.
Release order
Each repo releases once for v0.20.
- 0.19.x security patch for the API, server adapter and templates
@seamless-auth/types- Server adapters (JS, Go, Python, Rust) and the React, client and React Native SDKs
- Admin dashboard
- API 0.20.0, with the console pinned to that dashboard release by commit
- Templates, then the CLI pinning API, dashboard and templates
- Docs release notes and compatibility matrix; website changes deploy from main whenever ready
Before step 5, every deployment Fells Code runs has the secrets #447 requires.
Children are linked as sub-issues.
Activity
45 remaining items
Bccorb commentedon Oct 22, 2026
Contract for the recovery and staged policy work is fells-code/seamless-auth-types#108 (route table in its description), with #107 for the provider rules. Decisions:
recovery: true); the API answers403 enrollment_requiredelsewhere and the adapters'requireAuthrefuse them by default.BREAK_GLASS_EMAILS) that bypass login policy but still need a passkey, TOTP or recovery code.Types release first (0.30.0), then the API implements against it.