[security] M-10: Phone verification code exposed in URL

[jacobyoby]

Severity: Medium
File: phonelogin/views.py

Problem

Phone verification codes are included in URLs, leaking them via browser history, referrer headers, and server logs.

Remediation

Use POST body or session storage for verification codes instead of URL parameters.

Source

Finding from security audit (2026-08-31). See .github/SECURITY_AUDIT_TRIAGE.md.