docs(security): §8.3 — backend tokens are now bounded (30d) + revocable (#302)

[LukasWodka]

Summary

docs/SECURITY.md §8.3 still claimed backend tokens never expire ("no TTL... valid forever until manually deleted") with a stale mitigation plan. The tracked backend work has landed, so this rewords §8.3 (heading + body) to the current reality, per the issue's 3-point scope:

1. Data-scientist web sessions — mitigated: bounded, revocable 30-day ClientAccessToken (revocation via /auth/revoke, /logout/, password change, and a Django-admin bulk-revoke action; deliberately no refresh token). tracebloc/backend#933, tracebloc/frontend-app#575.
2. Edge devices / bots — by design: non-interactive service credentials keep the legacy non-expiring DRF Token, stated explicitly as intentional.
3. Residual risk: token in JS-readable browser storage stays tracked backend-side (SEC-06 residual follow-up to tracebloc/backend#590).

Also a 1-line polish of §9 step 3 (the incident-response edge-token line now points at §8.3), and a document-history entry. Verified no summary/gaps table elsewhere in the doc references §8.3 (the G-table only references §8 generally).

Related

Closes#302 · Refs tracebloc/backend#590, tracebloc/backend#933, tracebloc/frontend-app#575

Type of change

• Feature
• Bug fix
• Tech-debt / refactor
• Docs
• Security / hardening
• Breaking change

Test plan

Docs-only. Grepped the doc for 8.3 / token / expiry mentions — the only §8.3 references are the section itself and the (updated) §9 step 3 line. scripts/manifest.sha256 untouched (docs are not on the signed-manifest surface).

Checklist

• Tests added / updated and passing locally — N/A (docs-only)
• Docs updated if behavior or config changed
• No secrets / credentials in the diff
• For security-sensitive paths: appropriate reviewer requested

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only update to docs/SECURITY.md; no runtime, config, or credential handling changes in this repo.

Overview
§8.3 no longer states that all backend tokens never expire. It now distinguishes web sessions (30-day revocable ClientAccessToken, with revocation paths and no refresh token) from edge/bot credentials (legacy non-expiring DRF tokens, documented as intentional), and notes the XSS / JS-readable storage residual tracked backend-side.

§9 step 3 now tells operators to have the tracebloc team revoke leaked edge tokens because they do not expire on their own, with a pointer to §8.3.

§11 adds a 2026-07 history entry for this §8.3 refresh.

^{Reviewed by Cursor Bugbot for commit e282e88. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 42 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• backend#1040 — docs(rfc): configurable preprocessing & imputation (RFC 0003) · author: @LukasWodka · reviewer: @saadqbal
• backend#1076 — fix(taxonomy): drop dead instance_segmentation category (#1005) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1077 — feat(global_meta): audit/purge command for legacy per-row GlobalMeta (#1007) · author: @LukasWodka · no reviewer assigned
• cli#229 — fix(data): deprecation notices on renamed aliases + clear no-client message (fix(make): drop xargs -r so make lint runs on BSD xargs (backend#2200) #879) · author: @LukasWodka · reviewer: @saadqbal
• cli#230 — fix(data delete): resolve the table name case-insensitively; fail closed (#1027) · author: @LukasWodka · reviewer: @saqlainsyed007
• cli#231 — fix(doctor): surface container restart history, not just crash-loop-now (#1028 item 4) · author: @LukasWodka · no reviewer assigned
• cli#232 — feat(ingest): guide users from dataset to creating a use case · author: @LukasWodka · reviewer: @saadqbal
• cli#233 — fix(data ingest): preflight & message polish — schema-type validation, friendly missing-label, help copy, clearer errors (fix(install): visible wait on held apt lock instead of a silent spinner (#740) #213test: cross-repo fresh-shell last-mile E2E harness (install -> CLI -> cluster info -> push) #214Post-install self-verification of CLI usability (#738) #215fix(client): allow training pods to reach mysql-client (v1.2.1) #76) · author: @LukasWodka · no reviewer assigned
• cli#234 — fix(preflight): TSC group-integrity parity — mirror di#359 label-constant + time-order validators (test(drift): CI guard for source-of-truth drift (backend hosts + workload names) #218) · author: @LukasWodka · no reviewer assigned
• cli#235 — chore(cli): kubeconfig-flag helper + pinned lint/deadcode gate + dead-export cleanup (ingestor chart: default jobsManager.endpoint hardcodes 'tracebloc' namespace #127) · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[aptracebloc]

Closing as superseded by #342 (merged 2026-07-13), which already rewrote docs/SECURITY.md §8.3 to the same effect (backend tokens now bounded + revocable for DS web sessions; edge/bots keep the long-lived DRF token by design; residual JS-storage risk tracked in backend#971). This PR touches the same section and now conflicts (DIRTY) against the merged change, so there's nothing left to land here.

Thanks @LukasWodka — #302 is closed. Nothing needed on your side.