Carlos Escalante b4123703ef Rate-limit logins, constant-time creds, pin CORS, secure cookie ...

Both login endpoints now share verify_admin_credentials (hmac
compare_digest, SEC-02) and a 5/min/IP sliding-window rate limit that
returns 429 with Retry-After (SEC-03). CORS is pinned to the prod
domain and localhost dev origins instead of '*' (SEC-04). The session
cookie's Secure flag is driven by COOKIE_SECURE instead of hardcoded
false (SEC-08).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-09 19:13:19 -06:00

..

endpoints

Rate-limit logins, constant-time creds, pin CORS, secure cookie

2026-06-09 19:13:19 -06:00

__init__.py

Add budget module: FastAPI backend + React frontend

2026-03-21 11:33:38 -06:00

router.py

Remove Ahorro from budget UI, add SALARY type and savings auto-accrual

2026-04-15 19:13:29 -06:00