Better Auth's plugin fixes also require secret rotation Expo could sign attacker-supplied values; Electron could disclose server secrets. Update matching packages, rotate affected secrets and check session revocation.