BizzleBot 47c35c1e3a security: QA Council audit fixes ...

- Remove JWT secret fallbacks (fail on startup if missing)
- Hash refresh tokens with SHA-256 before DB storage
- Add Zod validation to bulk-approve, bulk-reject, update-user, copy-week
- Add global API rate limiting (100 req/15min per IP)
- Fix nginx X-XSS-Protection header (align with Helmet)
- Remove --accept-data-loss from Dockerfile CMD
- Create .gitignore to protect secrets from commits
- Secure .env file permissions (chmod 600)

2026-02-17 02:09:26 +00:00

..

backend

security: QA Council audit fixes

2026-02-17 02:09:26 +00:00

frontend

Coastal Timesheet v2 — full feature buildout

2026-02-16 10:01:39 +00:00

nginx

security: QA Council audit fixes

2026-02-17 02:09:26 +00:00

.env

Fix: ManageUsers component missing useAuth() - caused blank admin page

2026-02-16 20:24:34 +00:00

docker-compose.yml

Fix: ManageUsers component missing useAuth() - caused blank admin page

2026-02-16 20:24:34 +00:00