alexei.dolgolyov ff59d9f799 fix: security hardening for middleware, crypto, and backup handlers ...

- Remove CORS origin reflection (SEC-C1 CRITICAL)
- Add Content-Security-Policy header (SEC-H2)
- Fix rate limiter memory leak with periodic stale IP cleanup (SEC-H5)
- Enforce minimum 32-char ENCRYPTION_KEY (SEC-H4)
- Validate backup type against allowlist (SEC-M6)
- Fix backup download path traversal with path containment check (SEC-C2 CRITICAL)

2026-04-04 12:40:37 +03:00

..

auth.go

fix: comprehensive security, performance, and quality hardening

2026-03-29 12:49:24 +03:00

backups.go

fix: security hardening for middleware, crypto, and backup handlers

2026-04-04 12:40:37 +03:00

config_export.go

feat(docker-watcher): phase 12 - hardening

2026-03-27 23:20:56 +03:00

deploys.go

fix: comprehensive security, performance, and quality hardening

2026-03-29 12:49:24 +03:00

dns.go

fix: address final review findings

2026-04-02 15:04:53 +03:00

eventlog.go

feat(observability): phase 1 - schema, models & event log backend

2026-03-30 10:59:13 +03:00

health.go

feat: Docker diagnostic hints on disconnection

2026-03-30 14:05:00 +03:00

instances.go

feat(observability): phase 2 - stale container detection

2026-03-30 11:12:25 +03:00

middleware.go

fix: security hardening for middleware, crypto, and backup handlers

2026-04-04 12:40:37 +03:00

projects.go

fix: nil slices return [] not null in all API responses

2026-03-28 14:33:36 +03:00

proxy.go

fix(observability): address final review findings

2026-03-30 11:47:16 +03:00

registries.go

feat: support multiple owners per registry (comma-separated)

2026-03-28 14:15:42 +03:00

response.go

fix: comprehensive security, performance, and quality hardening

2026-03-29 12:49:24 +03:00

router.go

fix: address review findings for backup management

2026-04-02 15:39:54 +03:00

settings.go

fix: address review findings for backup management

2026-04-02 15:39:54 +03:00

sse.go

feat(observability): phase 1 - schema, models & event log backend

2026-03-30 10:59:13 +03:00

stage_env.go

feat(docker-watcher): phase 13 - volumes & environment

2026-03-27 23:28:59 +03:00

stages.go

feat(docker-watcher): phase 8 - REST API layer

2026-03-27 22:06:57 +03:00

stale.go

fix(observability): address final review findings

2026-03-30 11:47:16 +03:00

static.go

fix: serve SvelteKit _app assets correctly

2026-03-28 13:34:02 +03:00

stats.go

fix(observability): address final review findings

2026-03-30 11:47:16 +03:00

volume_browser.go

feat(volume-browser): absolute scope with allowlist security

2026-04-01 23:31:27 +03:00

volumes.go

feat(volume-browser): absolute scope with allowlist security

2026-04-01 23:31:27 +03:00