Skip to content

v0.1.4

Choose a tag to compare

View all tags
@engels74 engels74 released this 31 Dec 00:50
· 206 commits to main since this release
0.1.4
1d89c80
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Hardened application against common attack vectors (#10)
    • Added request filtering to block vulnerability scanner probes (.env, .git, wp-*, phpmyadmin, etc.)
    • Implemented global rate limiting with route-specific configurations (auth: 10/5min, API: 30/min, default: 60/min)
    • Added security headers: X-Frame-Options, HSTS, X-Content-Type-Options
    • Fixed cookie secure flag for production environments
    • Removed GET logout endpoint to prevent CSRF attacks
    • Sanitized error messages in onboarding endpoints

Full Changelog: v0.1.3...v0.1.4

Assets 2
Loading