Claude 804c2586a9 fix: tighten CSP, fix API key exposure, improve error handling ... - Remove 'unsafe-inline' from script-src CSP directive - Restrict connectSrc and imgSrc to known external domains - Move Google API key from URL query parameter to X-Goog-Api-Key header - Sanitize error logging in production (no stack traces) - Log file link errors instead of silently swallowing them https://claude.ai/code/session_01SoQKcF5Rz9Y8Nzo4PzkxY8		2026-03-31 00:33:56 +00:00
..
src	fix: tighten CSP, fix API key exposure, improve error handling	2026-03-31 00:33:56 +00:00
.env.example	harden runtime config and automate first-run permissions	2026-03-30 13:19:01 -03:00
package-lock.json	Merge branch 'pr-125'	2026-03-30 23:10:34 +02:00
package.json	Merge branch 'pr-125'	2026-03-30 23:10:34 +02:00
reset-admin.js	Stabilize core: better-sqlite3, versioned migrations, graceful shutdown	2026-03-22 17:52:24 +01:00
tsconfig.json	some fixes	2026-03-30 06:59:24 +02:00