Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Auth & User Management·14 in this wave

Approve: Auth & User ManagementTo do · blocker Remove Ben Ari hardcoded credentialsDone Confirm NEXT_PUBLIC_ALLOW_BEN_ARI_LOGIN unset in productionTo do Build /forgot-password routeDone Build /reset-password routeDone Wire email verification on signupDone Build account deletion UIDone Test JWT exp + refresh lifecycleDone Wire iOS native Google sign-inTo do Sign off: the seven completed Auth flowsTo do Add MFA optionTo do Build onboarding flowDone Wire orphan auth screens into navTo do Add biometric unlock to iOS and AndroidTo do

Wave

Auth & User Management

Depends on Backend API. Two hardcoded-credential items are security-critical and should run first.

TacTile › Launch TacTile › Backend & Infrastructure › Auth & User Management

7/14 done7 open1 open blocker

Selected taskclear

Confirm NEXT_PUBLIC_ALLOW_BEN_ARI_LOGIN unset in production

To doOwner · Vivt_1ac9c53a

SECURITY: verify the login-bypass flag is unset in prod.

Unlocks 1Approve: Auth & User Management

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Confirm NEXT_PUBLIC_ALLOW_BEN_ARI_LOGIN unset in production** · to do

SECURITY: verify the login-bypass flag is unset in prod.

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Auth & User Management

## Unlocks 1

- Approve: Auth & User Management

## The brief on file

Viv — verify the flag is unset in the production environment. Done when: confirmed unset. NOTE: this is now a belt-and-braces check only — apps/web/lib/security/no-dev-bypass.ts already hard-crashes the app at boot if this env var is ever set, so the risk is already structurally handled.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Auth & User Management

Confirm NEXT_PUBLIC_ALLOW_BEN_ARI_LOGIN unset in production