- Remove hardcoded fallback values for OIDC_KEY_SECRET, MFA_ENCRYPTION_KEY, and FORWARD_AUTH_SESSION_SECRET; fail-fast validation at startup when features are enabled - Escape all user-controlled template interpolations in OIDC login page (clientName, state, authCode, errorMessage) to prevent XSS - Replace URL query param secret display with one-time flash tokens (in-memory Map with 60s TTL, consumed on first access) - Update nodemailer from v6 to v7 (SES transport security fix) - Update docker-compose.yaml to use required variable syntax - Update .env.example with all current configuration options - Bump version to 2.0.2