Changes for version 0.06 - 2026-08-30

  • The default challenge form carries $c->csrf_field when the application enabled `csrf`, decided at to_app (on_compile) so declaration order does not matter; on Punk < 0.31 the key is read at registration instead
  • The default challenge page is sent Cache-Control: no-store

Modules

a second factor for Punk applications
HOTP and TOTP one-time passwords