Hamza-Ayed 214d96ee8d Security Hardening: Phase 1-3 complete ...

- C1: Hash refresh tokens before DB storage (sha256)
- C2: Remove JWT_SECRET fallback, fail hard if missing
- H1: Enforce HTTP methods per route (405 on mismatch)
- H2: CORS with origin whitelist from CORS_ORIGIN env var
- H3: Redact sensitive fields (tokens, passwords) from logs
- M1: Build HmacMiddleware with replay attack prevention
- M2: Fix rate limiter race condition with flock LOCK_EX
- M3: Guard dd() — suppressed in production
- M4: Remove .env from git tracking, strengthen .gitignore
- I1: Add HSTS header (max-age=31536000)

2026-05-03 21:06:17 +03:00

..

bootstrap

Security Hardening: Phase 1-3 complete

2026-05-03 21:06:17 +03:00

config

Update: 2026-05-03 17:32:57

2026-05-03 17:32:57 +03:00

core

Update: 2026-05-03 20:56:55

2026-05-03 20:56:55 +03:00

helpers

Security Hardening: Phase 1-3 complete

2026-05-03 21:06:17 +03:00

middleware

Security Hardening: Phase 1-3 complete

2026-05-03 21:06:17 +03:00

modules_app

Security Hardening: Phase 1-3 complete

2026-05-03 21:06:17 +03:00