Track all account activations, password events, and permission changes
Apply a one-time remediation to flag all non-Google users as requiring a password reset. This corrects accounts that may have been created during the period when a default password was in use. Google OAuth users are automatically excluded.
No security events logged yet
Hardcoded password "Password1234" removed from ClientActivationModal.jsx
Hardcoded password "Masterthenetwork1" removed from ClientActivation.jsx
Welcome emails no longer contain any password or credential
Activation flow uses Google OAuth or time-limited magic link only
Magic links expire in 24–48 hours and are stored per-account
SecurityAuditLog entity tracks all activations, deactivations, and resets
applyForcePasswordReset function available to flag legacy accounts
Force password reset remediation run on existing non-Google accounts
Run remediation above ↑