Token Protector v1.0.3

Runtime hardening and compatibility

• Removed the public mutable TokenStash token holder and unused plaintext SafeUser copy.
• Removed the access token from public-facing TokenVault data; redirected authentication reads it from an internal holder.
• Retained the requested whitelist behaviour for trusted applications.
• Disabled the NONE replacement mode for access-token and session-ID protection, and normalize existing credential settings to fake values.
• Made critical authentication redirects required so a missing target fails loudly instead of silently leaving a gap.
• Split authlib request mixins by supported Minecraft/authlib versions, fixing the authlib 9 / Minecraft 26.2 startup incompatibility while retaining the authlib 7 path.
• Reduced the environment-leak diagnostic from a large token prefix to a short masked preview with token length.

Documentation and security scope

• Narrowed absolute claims to documented, regression-tested in-game access paths.
• Documented the limits raised in the review: hostile same-JVM mods, mixin cancellation/priority changes, earlier bootstrap hooks, transformers/agents, alternative egress hooks, launcher sources, and disk credential files.
• Clarified that whitelisting is an explicit trust decision and can supply real credentials.
• Changed “Blocked” wording to “Tested: fake result” when the statement is based on the regression harness.
• Added FAQ answers covering mixin cancellation/priority, earlier bootstrap hooks, why per-launch renaming is not a security boundary, and launcher/external credential sources.

Important limitation

These changes harden the implementation and make its claims accurate. They do not turn Fabric mods into a sandbox: code running in the same JVM can deliberately target TokenProtector or use credential sources outside its covered paths. This is known and obvious but was not clearly stated in previous releases.