admin/WealthySmart

mirror of https://github.com/escalante29/WealthySmart.git synced 2026-07-17 09:08:46 +02:00

Go to file

Carlos Escalante b4123703ef Rate-limit logins, constant-time creds, pin CORS, secure cookie

Both login endpoints now share verify_admin_credentials (hmac
compare_digest, SEC-02) and a 5/min/IP sliding-window rate limit that
returns 429 with Retry-After (SEC-03). CORS is pinned to the prod
domain and localhost dev origins instead of '*' (SEC-04). The session
cookie's Secure flag is driven by COOKIE_SECURE instead of hardcoded
false (SEC-08).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-09 19:13:19 -06:00

.github/workflows

Pass OPENAI_API_KEY and AGENT_MODEL to prod from Gitea secrets

2026-04-29 22:49:55 -06:00

Rate-limit logins, constant-time creds, pin CORS, secure cookie

2026-06-09 19:13:19 -06:00

codebase-review

Add five-hat codebase review and phased improvement plan

2026-06-09 19:13:19 -06:00

Point sync-db at old-vps and add A2UI theming notes

2026-04-29 22:02:58 -06:00

Proxy /api/v1 and /api/auth from Hono to FastAPI in prod

2026-04-29 22:43:34 -06:00

Point sync-db at old-vps and add A2UI theming notes

2026-04-29 22:02:58 -06:00

.env.example

Fail fast on missing or weak auth secrets; 7-day tokens

2026-06-09 19:13:19 -06:00

.gitattributes

Initial commit

2026-03-21 08:30:01 -06:00

.gitignore

Ignore tech_docs and local Claude state

2026-04-29 21:57:58 -06:00

CLAUDE.md

Fail fast on missing or weak auth secrets; 7-day tokens

2026-06-09 19:13:19 -06:00

docker-compose.prod.yml

Fix prod backend hostname collision on nginx-prod-network

2026-04-29 22:31:16 -06:00

docker-compose.yml

Fail fast on missing or weak auth secrets; 7-day tokens

2026-06-09 19:13:19 -06:00

README.md

Initial commit

2026-03-21 08:30:01 -06:00

README.md

WealthySmart

A financial management application

Languages

TypeScript 65.2%

Python 33.3%

CSS 0.6%

Shell 0.4%

Dockerfile 0.2%

Other 0.1%