SECURITY_IMPACTING_SETTINGS_KEYS (constants/securityImpactingSettings.ts)

List of settings keys that require re‑authentication or are security‑impacting.

// Source: https://github.com/diegosouzapw/OmniRoute | License: MIT | Copyright 2026 diegosouzapw
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Settings keys whose change broadens attack surface. Spec §Security:
 * `PATCH /api/settings` requires password re-auth when any of these is present
 * in the body, and every other settings writer that skips that gate (e.g. the
 * legacy JSON import) MUST drop them instead of persisting them.
 *
 * - `localOnlyManageScopeBypassEnabled` / `localOnlyManageScopeBypassPrefixes`:
 *   T-011 bypass kill-switch + per-prefix list. Operator must re-confirm
 *   before broadening the LOCAL_ONLY carve-out.
 * - `requireLogin`: dashboard login enforcement toggle.
 * - `newPassword`: password rotation (existing). Handled by the same gat

... (truncated -- full source via MCP)