Hartmut 534945f6e3 security: bound password inputs, configure pino redact, patch deps (#36 #46 #58) ...

#36 CRITICAL: add .max(128) to all password Zod schemas to prevent
Argon2-based DoS from unbounded password strings.

#46 HIGH: configure pino redact paths so passwords/tokens/cookies/TOTP
secrets are never serialized in logs.

#58 MEDIUM: upgrade dompurify to ^3.4.0 and add pnpm overrides for
brace-expansion (>=5.0.5) and esbuild (>=0.25.0) to patch known CVEs.
Vite moderate (path traversal, dev-only) remains — requires vitest 3.x
major upgrade, deferred.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-17 08:13:25 +02:00

..

web

security: bound password inputs, configure pino redact, patch deps (#36 #46 #58)

2026-04-17 08:13:25 +02:00