Security context

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/index.js: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: During component updates, authorization checks evaluated incorrect or stale data because the current authData was not properly passed, allowing unauthorized component rendering.

Auth Bypass: In SSR and early route transitions, the onEnter hook failed to inspect the `isAuthenticating` state before enforcing redirect rules, causing bypasses during complex initial loads.

Auth Bypass: Transitioning out of an authenticating state without verifying that the user successfully achieved authorization allowed users to bypass the redirection to login.