Hi @dev@microblog.pub
Please look at the issue that I raised based on your observation that "Reverify credentials" accesses public (not protected) endpoint and hence doesn't actually check access https://github.com/andstatus/andstatus/issues/574