Sessions are stateless 7-day JWTs. Logout cannot invalidate a stolen/leaked token server-side before expiry.
Location: platform/ui/lib/auth.ts:26.
Fix: Add a session/jti store (or token-version column) checked on each request, or shorten TTL with refresh tokens.
Sessions are stateless 7-day JWTs. Logout cannot invalidate a stolen/leaked token server-side before expiry.
Location:
platform/ui/lib/auth.ts:26.Fix: Add a session/jti store (or token-version column) checked on each request, or shorten TTL with refresh tokens.