[P2] Separate implemented security behavior from future requirements and correct credential expiry

[michielbdejong]

Recorded during review of main at a1eb305ccfa2f3fc8ddede4875765cf1b099bd2b. This issue records a finding only; no implementation changes were made or requested.

Finding

SECURITY.md mixes descriptions of current behavior with future requirements/release gates. It still says proxy credentials have five-minute idle expiry, while store_connection_code issues ten-minute credentials. OAuth handoffs retain their separate five-minute lifetime. The document also uses Google-specific tenant-login terminology even though application login endpoints are configurable OIDC.

Evidence

• SECURITY.md:1
• src/security.rs:167
• src/auth.rs:20

Desired outcome

Clearly distinguish guarantees implemented today from outstanding requirements. Correct proxy-credential lifetime while preserving the separate handoff lifetime, and use accurate configurable-login terminology.

[michielbdejong]

Fixed in #73 — corrected SECURITY.md's stale "five-minute idle expiry" claim for proxy credentials to ten minutes (matching store_connection_code), while keeping the handoff code's separate five-minute lifetime explicit. Also added a line pointing to "Release gate" as the authoritative implemented-vs-outstanding split for the OAuth/Validating-proxy requirement sections. The "Google-specific tenant-login terminology" this issue also flagged was no longer present in the current SECURITY.md.

---

Generated by Claude Code