From 0a5d8a0642379b884f2703763effc82857e6f5ed Mon Sep 17 00:00:00 2001 From: Sacha Al Himdani Date: Mon, 4 May 2026 19:08:08 +0200 Subject: [PATCH] Add security notes with safer password changes entry Signed-off-by: Sacha Al Himdani --- SECURITY_NOTES.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 SECURITY_NOTES.md diff --git a/SECURITY_NOTES.md b/SECURITY_NOTES.md new file mode 100644 index 000000000..589ea6a37 --- /dev/null +++ b/SECURITY_NOTES.md @@ -0,0 +1,18 @@ +# Security Notes + +User-facing notes on security-relevant changes to Probo. For the +vulnerability reporting process, see [SECURITY.md](SECURITY.md). + +## Safer Password Changes + +_2026-04-29 — **IAM**_ + +> Changing or resetting a password now revokes old sessions automatically. + +Changing a password should close the door behind it. Probo now revokes existing sessions when credentials change. + +If you change your password while signed in, every other active session is expired and your current session stays open. If your password is reset, all sessions are expired. + +It is a small security detail, but an important one. A password update now does what people expect: it cuts off old access immediately. + +Thanks to [emimoir](https://github.com/emimoir) for reporting the security issue behind this fix.