security: Fix critical security vulnerabilities

- Remove secrets from Git (.env)
- Remove debug token endpoint
- Fix login to reject unauthorized access in production
- Remove HS256 fallback in JWT validation (RS256 only)
- Fix SQL injection in journal.go countQuery
- Fix CORS to use explicit origins only (no wildcard)
- Add security headers middleware (CSP, HSTS, etc.)
- Add input validation helpers
- Build successful

This commit is contained in:

Bernt

2026-08-10 11:26:58 +00:00

parent cb4a273733

commit 8921fd1467

9 changed files with 404 additions and 245 deletions

.gitignore

View File

@@ -0,0 +1,2 @@
 .env
 .env.*