BizzleBot
47c35c1e3a
- Remove JWT secret fallbacks (fail on startup if missing) - Hash refresh tokens with SHA-256 before DB storage - Add Zod validation to bulk-approve, bulk-reject, update-user, copy-week - Add global API rate limiting (100 req/15min per IP) - Fix nginx X-XSS-Protection header (align with Helmet) - Remove --accept-data-loss from Dockerfile CMD - Create .gitignore to protect secrets from commits - Secure .env file permissions (chmod 600)
16 lines
126 B
Plaintext
16 lines
126 B
Plaintext
# Secrets
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
docker/.env
|
|
*.pem
|
|
*.key
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
|
|
# Runtime
|
|
*.log
|
|
.DS_Store
|
|
dist/
|