1 commit

Author	SHA1	Message	Date
ifedan-ed	4fc7f7f033	Security: CSP, CORS origin lock, 1mb body limit, auth brute-force rate limits ... - Enable Helmet CSP (scripts/styles/fonts/connect restricted to self + CDNs) - Lock CORS to APP_URL origin in production (open in dev) - Reduce JSON body limit from 50mb to 1mb - Add per-route rate limits: login 10/15min, register 5/hr, forgot-pw 5/hr - Add README with full setup, Docker Hub, provider switching, env reference - Bump version to 3.0.0	2026-03-21 19:32:40 -04:00