oikos

Files

T

Ulas 6e0eda8ba4 fix(security): address multiple security findings from audit

- Fix SQLCipher PRAGMA key interpolation (hex-encode key to prevent crash on single quotes)
- Enforce min password length (8 chars) on admin user creation
- Add length bounds on username/display_name and login inputs
- Invalidate other sessions on password change
- Multi-stage Docker build (exclude build tools from runtime)
- Exclude docs/ from Docker image
- Consolidate dotenv.config() to single entry point
- Document flat family authorization model in SECURITY.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-04-03 09:11:17 +02:00

middleware

fix: enforce Secure flag on session and CSRF cookies by default

2026-04-01 18:34:31 +02:00

routes

fix: address CodeQL security findings (v0.5.2)

2026-04-01 18:30:03 +02:00

services

feat: Apple CalDAV credentials form + connect/disconnect UI (BL-04)

2026-03-31 10:27:07 +02:00

auth.js

fix(security): address multiple security findings from audit