davide 45a50dc906 fix(security): whitelist allowed keys in admin settings endpoint ...

Reject any key not in the explicit allowlist before writing to the database,
preventing arbitrary configuration injection by a malicious admin.

2026-05-19 10:10:42 +02:00

..

app

fix(security): whitelist allowed keys in admin settings endpoint

2026-05-19 10:10:42 +02:00

components

fix(security): replace localStorage user state with server-side session

2026-05-19 10:10:24 +02:00

context

fix(security): replace localStorage user state with server-side session

2026-05-19 10:10:24 +02:00

lib

fix(security): validate file uploads with magic bytes, remove SVG from favicon whitelist

2026-05-19 10:09:53 +02:00

middleware.ts

fix(security): add HTTP security headers (CSP, HSTS, X-Frame-Options)

2026-05-19 10:10:08 +02:00