Lock bootstrap admin token until password is changed #6

Merged

Ghost merged 1 commits from fix/helix-2-bootstrap-lock into master

2026-08-31 22:57:37 -05:00

Author	SHA1	Message	Date
s1d3sw1ped_bot	13070a275d	Lock bootstrap admin token until password is changed. Format / gofmt (push) Successful in 7s Details CI / Build (push) Successful in 14s Details Format / gofmt (pull_request) Successful in 7s Details CI / Build (pull_request) Successful in 13s Details CI / Go Tests (push) Successful in 50s Details CI / Go Tests (pull_request) Successful in 48s Details Closes #2: bootstrap JWTs cannot mutate admin APIs except change-password, production requires ADMIN_PASSWORD on first boot, admin binds loopback.	2026-09-01 03:54:09 +00:00