Issues

• Session lifetime is a fixed 7 days with no renewal; make it application policy

  BlockchainCommons/passkey-cloudflare#19 · Filter by author peterkaminski opened on Oct 8, 2026

• Removing a member keeps all of their device data forever; no erasure or retention path

  BlockchainCommons/passkey-cloudflare#18 · Filter by author peterkaminski opened on Oct 8, 2026

• User verification is recorded but can never be required, even for step-up-gated and operator actions

  BlockchainCommons/passkey-cloudflare#17 · Filter by author peterkaminski opened on Oct 8, 2026

• Docs for AIs: an AGENTS.md and an intake prompt a person's agent can run before registration

  BlockchainCommons/passkey-cloudflare#16 · Filter by author peterkaminski opened on Oct 8, 2026

• Rate limiting keys only on CF-Connecting-IP; behind a fronting Worker or on self-hosted workerd every caller shares one bucket

  BlockchainCommons/passkey-cloudflare#15 · Filter by author peterkaminski opened on Oct 8, 2026

• Member names are Latin-letters-only, mandatory, and never changeable

  BlockchainCommons/passkey-cloudflare#14 · Filter by author peterkaminski opened on Oct 8, 2026

• Bearer callers can authenticate but cannot POST: the Origin check refuses every non-browser request

  BlockchainCommons/passkey-cloudflare#13 · Filter by author peterkaminski opened on Oct 8, 2026

• A hostname change strands every passkey; hosting operators need a migration story

  BlockchainCommons/passkey-cloudflare#12 · Filter by author peterkaminski opened on Oct 8, 2026

• Allow more than one origin per deployment (staging hosts, subdomain fleets)

  BlockchainCommons/passkey-cloudflare#11 · Filter by author peterkaminski opened on Oct 8, 2026

• Bootstrapping the first operator needs a human loop and a redeploy; a one-time setup token would allow unattended provisioning

  BlockchainCommons/passkey-cloudflare#10 · Filter by author peterkaminski opened on Oct 8, 2026

• A hosting operator cannot issue a rebind link without holding an operator passkey on every deployment it hosts

  BlockchainCommons/passkey-cloudflare#9 · Filter by author peterkaminski opened on Oct 8, 2026

• Let a deployment be the identity for other services: an OIDC provider, or at least provisioning hooks

  BlockchainCommons/passkey-cloudflare#8 · Filter by author peterkaminski opened on Oct 8, 2026

• Agent principals exist in the schema but have no credential type and no way to be created

  BlockchainCommons/passkey-cloudflare#7 · Filter by author peterkaminski opened on Oct 8, 2026

• No way to bind a first passkey to a principal the application has already verified

  BlockchainCommons/passkey-cloudflare#6 · Filter by author peterkaminski opened on Oct 8, 2026

• The global rate-limit buckets let anyone lock out login, registration and recovery for everyone

  BlockchainCommons/passkey-cloudflare#5 · Filter by author peterkaminski opened on Oct 8, 2026

• Sign-in pane blocks LastPass passkey picker; overlapping logins show a refusal while signed in

  bug
  BlockchainCommons/passkey-cloudflare#1 · Filter by author ChristopherA opened on Oct 6, 2026
  2