// notes

Research notes

Findings. Command, output, proof.

1. 12 Aug 2026 / web / auth

   Session cookies survived a password reset

   A password reset hashed a new secret and left the existing session cookie valid for 14 days.