vulncheck
406d1ca6d9
Settings -> Security gets a "TOTP hash algorithm" selector (setting totp_algorithm). It applies to new enrolments only, self-service and forced alike. Each account keeps the algorithm it was issued with in users.totp_algorithm (migration 068, NULL = SHA-1), so switching the setting never breaks an enrolled authenticator and SHA-1 and SHA-2 tokens coexist. Secret length follows RFC 6238 (160/256/512 bit); the otpauth URI carries algorithm= for SHA-2. The enrolment screens warn that Microsoft Authenticator and some built-in phone authenticators only do SHA-1. Disable and admin MFA reset clear the stored algorithm.
TrueVuln Frontend
Next.js 16 (App Router) UI for TrueVuln. See the root README for setup, deployment, and configuration — this app is deployed via Docker Compose alongside the backend, not standalone or on Vercel.
Local dev (without Docker)
npm install
npm run dev
Open http://localhost:3000. The dev server proxies API calls to the backend — see ../README.DEV.md for the full local (non-Docker) setup.