brunorezioandClaude Opus 5 8163f04420 fail closed when PUBLIC_BUILD_ENV is unset ...

Origin validation, every rate limiter and the password-strength check each
treated an unset PUBLIC_BUILD_ENV as "relaxed", so a deployment that forgot the
variable silently ran with CORS reflecting any origin, no brute-force limit on
the sole account, and no password rules. setup.sh writes it, but .env.example
never mentioned it.

The three now share IS_DEV_BUILD, which is true only when PUBLIC_BUILD_ENV is
explicitly "dev" or "development". Anything else, including unset, is hardened.
Documented in .env.example.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-07-25 23:30:20 +01:00

..

auth.ts

remove the dead multi-user surface

2026-07-25 23:30:20 +01:00

bootstrap.ts

remove the dead multi-user surface

2026-07-25 23:30:20 +01:00

change-password.ts

fail closed when PUBLIC_BUILD_ENV is unset

2026-07-25 23:30:20 +01:00

client-ip.ts

add token revoke and panic lockdown endpoints with security logging

2026-07-23 00:48:44 +00:00

forgot-password.ts

migration to postgres

2026-02-26 17:42:59 +00:00

index.ts

first

2026-02-16 19:34:35 +00:00

panic-handler.ts

add token revoke and panic lockdown endpoints with security logging

2026-07-23 00:48:44 +00:00

panic.ts

add token revoke and panic lockdown endpoints with security logging

2026-07-23 00:48:44 +00:00

passkey-router.ts

remove the dead multi-user surface

2026-07-25 23:30:20 +01:00

reset-password.ts

migration to postgres

2026-02-26 17:42:59 +00:00

revoke-handler.ts

log token revoke as a security event

2026-07-23 00:59:19 +00:00

signin.ts

remove the dead multi-user surface

2026-07-25 23:30:20 +01:00

signout.ts

file based auth

2026-02-23 09:58:08 +00:00

users-me.ts

migration to postgres

2026-02-26 17:42:59 +00:00

validate-password.ts

first

2026-02-16 19:34:35 +00:00

validate-username.ts

workspaces to dashboards, imap email sync, ffmpeg tool, tts fix, file browser refresh, automation sidebar reorder

2026-03-02 20:00:45 +00:00

verify-token.ts

remove the dead multi-user surface

2026-07-25 23:30:20 +01:00