yeuimu
9c1106586a
- Lock public registration to first-user bootstrap (403 afterwards) - Require JwtAuthGuard on upload + whitelist png/jpg/webp/gif (SVG/XSS blocked) - Add global throttling (login/register 5/min, upload 10/min) - Add helmet security headers; serve uploads with nosniff - Replace permissive CORS (origin:true+credentials) with CORS_ORIGINS whitelist - Disable Swagger outside development; sanitize 500 error responses - Enforce 32+ char JWT_SECRET; make token expiry configurable (TOKEN_EXPIRES_IN) - Re-check user in DB on every JWT validation (revocation on user delete) - Dummy bcrypt compare to prevent login user-enumeration via timing - Map malformed BigInt inputs to 400 instead of 500 - Widen .gitignore to .env* and add apps/api/.env.example - Disable Nuxt devtools and sourcemaps
45 lines
390 B
Plaintext
45 lines
390 B
Plaintext
# Dependencies
|
|
node_modules
|
|
|
|
# Build outputs
|
|
dist
|
|
.output
|
|
.nuxt
|
|
.nitro
|
|
.data
|
|
.cache
|
|
|
|
# TypeScript
|
|
*.tsbuildinfo
|
|
|
|
# Logs
|
|
logs
|
|
*.log
|
|
npm-debug.log*
|
|
pnpm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
lerna-debug.log*
|
|
|
|
# Environment
|
|
.env*
|
|
!.env.example
|
|
|
|
# OS
|
|
.DS_Store
|
|
|
|
# IDE
|
|
.idea
|
|
.vscode/*
|
|
!.vscode/settings.json
|
|
!.vscode/extensions.json
|
|
|
|
# Coverage
|
|
coverage
|
|
|
|
# Nuxt
|
|
.output
|
|
.nuxt
|
|
.nitro
|
|
.cache
|