214d96ee8d
- C1: Hash refresh tokens before DB storage (sha256) - C2: Remove JWT_SECRET fallback, fail hard if missing - H1: Enforce HTTP methods per route (405 on mismatch) - H2: CORS with origin whitelist from CORS_ORIGIN env var - H3: Redact sensitive fields (tokens, passwords) from logs - M1: Build HmacMiddleware with replay attack prevention - M2: Fix rate limiter race condition with flock LOCK_EX - M3: Guard dd() — suppressed in production - M4: Remove .env from git tracking, strengthen .gitignore - I1: Add HSTS header (max-age=31536000)
22 lines
267 B
Plaintext
22 lines
267 B
Plaintext
# Secrets — NEVER commit these
|
|
.env
|
|
.env.*
|
|
config/secrets.php
|
|
|
|
# Storage — runtime data, not code
|
|
storage/invoices/
|
|
storage/logs/
|
|
storage/exports/
|
|
storage/cache/
|
|
|
|
# Dependencies
|
|
vendor/
|
|
node_modules/
|
|
|
|
# Dev tools
|
|
scratch.js
|
|
describe.php
|
|
.DS_Store
|
|
.idea/
|
|
.vscode/
|