| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | email: escape support form HTML and enforce recaptcha v3 score | Adam Soltys | 8 days | 1 | -37/+56 |
| | | | | | | | | | Escape the message body, stop accepting a client-supplied subject, strip control characters from header values, require the expected action and a minimum score from siteverify, and drop the adminpass captcha bypass. Co-Authored-By: Claude Opus 5.5 <[email protected]> | ||||
| * | auth: fail closed on adminpass, scrub sample secrets (S3) | Adam Soltys | 2026-08-07 | 1 | -1/+1 |
| | | | | | | | | | | | | | | | | | The master-password path (isAdmin = password === config.adminpass) logs in as any user, skipping password, 2FA, and captcha. Worse, when adminpass is unset an omitted password field made undefined === undefined true, authenticating as anyone. Require both the configured value and the supplied password to be non-empty and match exactly, across every adminpass comparison (login, recaptcha bypass, support email, freeze). Also scrub config.ts.sample: the sample shipped a working-looking JWT secret, two server nsec keys, and adminpass "pwa". Replace with fail-closed placeholders and regenerate instructions. Rotate any deployment that ever shipped the sample values. Co-Authored-By: Claude Opus 4.8 <[email protected]> | ||||
| * | remove logs | Adam Soltys | 2026-03-17 | 1 | -3/+1 |
| | | |||||
| * | biome lint | Adam Soltys | 2024-10-31 | 1 | -7/+7 |
| | | |||||
| * | typescript | Adam Soltys | 2024-08-26 | 1 | -0/+61 |
 |
index : coinos-server.git | |
| coinos server — legacy coinos.io backend (Lightning, on-chain, Liquid) | coinos |
| aboutsummaryrefslogtreecommitdiffstats |