Security (low): sessions are long-lived and cannot be revoked one by one issue #223 closed: completed andymccall opened this 20 days ago · 0 comments

External review: sessions derive from the account's session salt, last 30 days, and can only all be revoked together. Random server-side session records; rotate on sign-in and on privilege changes; idle and absolute expiry; Settings > Security lists sessions (device, place, last seen) with Sign out for each, keeping Sign out everywhere.