Kyle Pope a0b50a2b13 Remediate pentest findings F-01, F-02, F-06 ...

- Remove ineffective in-memory IP rate limiter from auth.py (F-01):
  nginx limit_req_zone handles real-IP throttling, DB lockout is the per-user guard
- Block RFC 1918 + IPv6 ULA ranges in ntfy SSRF guard (F-02):
  prevents requests to Docker-internal services via user-controlled ntfy URL
- Rate-limit /api/auth/setup at nginx with burst=3 (F-06)
- Document production deployment checklist in .env.example (F-03/F-04/F-05)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-26 02:25:37 +08:00

..

auth.py

Implement Stage 6 Track A: PIN → Username/Password auth migration

2026-02-25 04:12:37 +08:00

ntfy_templates.py

Implement Track C: NTFY push notification integration

2026-02-25 04:04:23 +08:00

ntfy.py

Remediate pentest findings F-01, F-02, F-06

2026-02-26 02:25:37 +08:00

recurrence.py

Fix QA findings: firstDay reactivity, state revert, helper extraction

2026-02-22 02:02:15 +08:00

totp.py

Implement Stage 6 Track B: TOTP MFA (pyotp, Fernet-encrypted secrets, backup codes)

2026-02-25 04:18:05 +08:00