# Open Points

Tracked open points and their timelines, generated from every `## Open Points` section in the wiki. Grouped open-first; each links to the host page, which carries the citations. Generated — do not edit.

## Open (4)

### Full staff MFA coverage
host: [Nordvane MFA Rollout](../projects/nordvane-mfa-rollout.md) · updated 2025-09-12 · id: op-mfa-full-coverage
- 2025-09-12: 92% of staff accounts covered, up from 74% at the Q2 2025 checkpoint; remaining 8% are shared operational accounts needing a hardware-token path rather than an app; target for full coverage end of October 2025 (reported by Devin Osei).

### Missing rate limit on password-reset endpoint
host: [Nordvane Q3 2025 Security Review](../projects/nordvane-q3-2025-security-review.md) · updated 2025-09-12 · id: op-password-reset-rate-limit
- 2025-09-12: raised by Halden Audit Partners as a medium-severity finding in the Q3 2025 review; assigned to Devin Osei, due 26 September 2025; Rahel Zimmer will re-test before sign-off.

### Verbose error page leaking framework version
host: [Nordvane Q3 2025 Security Review](../projects/nordvane-q3-2025-security-review.md) · updated 2025-09-12 · id: op-verbose-error-page
- 2025-09-12: raised as a medium-severity finding in the Q3 2025 review; assigned to Priya Anand's platform team, due 30 September 2025; Rahel Zimmer will re-test before sign-off.

### Session cookie missing SameSite attribute on legacy subdomain
host: [Nordvane Q3 2025 Security Review](../projects/nordvane-q3-2025-security-review.md) · updated 2025-09-12 · id: op-session-cookie-samesite
- 2025-09-12: raised as a medium-severity finding, affecting one legacy subdomain's session cookie; folded into the legacy-subdomain retirement already tracked under ticket PLT-4471, due end of Q4 2025.
