- device-token.mjs was unauthenticated, returning any user's claude/github tokens by handle. Gate behind AC_DEVICE_SECRET (constant-time, fails closed). - New device-creds.mjs helper: single source of truth for per-user OS provisioning secrets, stored in dedicated device-creds collection keyed by sub — off the @handles docs that get $lookup-joined into public content. - Re-wire claude-token, device-pair, device-token to the helper. - piece-fans/piece-hit: project handle reads to {_id,handle} (defense-in-depth). - migration moves existing @handles.{claudeCodeToken,githubPat} into device-creds.