security/fix: comprehensive app hardening, restore OAuth login, and normalize note tags - #137

Open

jakharmonika364 wants to merge 10 commits into

Coder-s-OG-s:mainfrom

Ayush-Patel-56:security/fix-all-vulnerabilities

Commits on Jun 6, 2026

security: remove root JS/config.js and strip GROQ_API_KEY from client bundle
jakharmonika364
committed
647f8c7
security: move Groq AI calls to server-side proxy (C4)
jakharmonika364
committed
8ad4e77
security: fix mass assignment, error leakage and add input validation (H1-H3, M5)
jakharmonika364
committed
78e5102
security: add rate limiting, restrict CORS, CSRF protection, harden session (H4, H5, M3, M4)
jakharmonika364
committed
cce810f
security: sanitize /api/auth/user response - strip googleId, githubId, _id (M1)
jakharmonika364
committed
f4f2f7a
security: add DOMPurify XSS sanitization for note content and AI output (H6, L2)
jakharmonika364
committed
7d35d38
security: client-side hardening - config parser, error guards, stale comments (L1, L3, L4, M2)
jakharmonika364
committed
5bd2c7d
fix: restore OAuth sign-in by fixing middleware order and SameSite cookie
jakharmonika364
committed
3b61758
fix: normalize note tags to array and fix DOMPurify SRI integrity hash
jakharmonika364
committed
d8112bc

Commits on Jun 12, 2026

fix: remove stale config.js import and fix AI error handling in client
jakharmonika364
committed
c67ba71