Validate BRL tax IDs and bind KYC to the claimed CPF - #1395

Open

ebma wants to merge 10 commits into

fix/api-cpf-claim-guard

Commits on Sep 29, 2026

fix(api): validate createSubaccount name and tax id before any provider call
ebma
committed
c1a152d
fix(api): bind KYC and KYB submissions to the tax id claimed for the subaccount
ebma
committed
d63c1a7
fix(api): limit probes of other profiles' tax ids on the brl routes

ebma
and
claude
committed
d8af303
docs(api): document createSubaccount validation, tax id binding and the 429 limit
ebma
committed
08c440b
docs(repo): add operator runbook for releasing a squatted BRL tax id
ebma
committed
15f37c7
docs(repo): sync the security spec with the tax-id claim guards
ebma
committed
23dbb98

Commits on Sep 30, 2026

Commits on Oct 1, 2026