See coordinator findings S-AcctDel. Two gaps in AccountDeletionService: (1) The sole-owner guard scans BoardAccess rows with Owner role, but board creation sets only Board.OwnerId (no Owner row is ever created), so the guard never fires for normal owners — an owner can delete their account and permanently orphan boards (worse than #3424's reversible deactivation). Fix: guard on Boards owned via OwnerId (plus Owner-role rows). (2) MFA credentials (MfaCredentials.DeleteByUserIdAsync exists) and API keys are not deleted; the user row is anonymized in place so FK cascades never fire. API keys are functionally dead via the owner-active check, but MFA secrets linger — delete both, and clear MfaEnabled on the anonymized record. Deletion otherwise verified thorough (re-auth, transactional, token invalidation, PII scrub, cache invalidation).
See coordinator findings S-AcctDel. Two gaps in AccountDeletionService: (1) The sole-owner guard scans BoardAccess rows with Owner role, but board creation sets only Board.OwnerId (no Owner row is ever created), so the guard never fires for normal owners — an owner can delete their account and permanently orphan boards (worse than #3424's reversible deactivation). Fix: guard on Boards owned via OwnerId (plus Owner-role rows). (2) MFA credentials (MfaCredentials.DeleteByUserIdAsync exists) and API keys are not deleted; the user row is anonymized in place so FK cascades never fire. API keys are functionally dead via the owner-active check, but MFA secrets linger — delete both, and clear MfaEnabled on the anonymized record. Deletion otherwise verified thorough (re-auth, transactional, token invalidation, PII scrub, cache invalidation).