1## Why23A September penetration test flagged our 30-day idle sessions (90 days with "Remember me") as high risk: a stolen cookie stays valid for months and users have no way to sign out other devices. Our SOC 2 auditor wants a fix before the October audit window closes.45## What Changes67- Shorten the idle timeout to 12 hours and add a 7-day absolute session lifetime8- Let users see and revoke their active sessions9- **BREAKING**: Remove the "Remember me" option; all sessions follow the same lifetime rules10- Rename the "Password login" requirement to "Password authentication" to match the security glossary1112## Capabilities1314### New Capabilities15<!-- None -->1617### Modified Capabilities18- `user-auth`: Session expiry rules tightened, session revocation added, remember-me removed, password login renamed1920## Impact2122- `sessions` table gains `absolute_expires_at`; `remember_me` column dropped one release later23- Session middleware enforces both timeouts24- New "Active sessions" page under account settings25- Users will be signed out more often; support macro needed