olsch01 61a4f27af4 security: address assessment findings and bump to v2026.3.11 ...

- C1: Disable Swagger UI in production (env gate)
- M1+M2: Add Helmet.js for security headers (CSP, X-Frame-Options,
  X-Content-Type-Options, Referrer-Policy) and remove X-Powered-By
- H2: Add @nestjs/throttler rate limiting (5 req/min on login/register)
- M4: Remove orgSchema from JWT payload and client-side storage;
  tenant middleware now resolves schema from orgId via cached DB lookup
- L1: Fix Chatwoot user identification (read from auth store on ready)
- Remove schemaName from frontend Organization type and UI displays

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-11 15:22:58 -04:00

..

src

security: address assessment findings and bump to v2026.3.11

2026-03-11 15:22:58 -04:00

Dockerfile

Prod infra: frontend on port 3001, remove certbot from compose

2026-03-02 19:43:14 -05:00

Dockerfile.dev

Initial commit: HOA Financial Intelligence Platform MVP

2026-02-17 19:58:04 -05:00

index.html

security: address assessment findings and bump to v2026.3.11

2026-03-11 15:22:58 -04:00

nginx.conf

Prod infra: frontend on port 3001, remove certbot from compose

2026-03-02 19:43:14 -05:00

package-lock.json

fix: budget save error and add read-only view mode (v2026.03.10)

2026-03-10 14:28:09 -04:00

package.json

security: address assessment findings and bump to v2026.3.11

2026-03-11 15:22:58 -04:00

postcss.config.cjs

Initial commit: HOA Financial Intelligence Platform MVP

2026-02-17 19:58:04 -05:00

tsconfig.json

Initial commit: HOA Financial Intelligence Platform MVP

2026-02-17 19:58:04 -05:00

tsconfig.node.json

Initial commit: HOA Financial Intelligence Platform MVP

2026-02-17 19:58:04 -05:00

vite.config.ts

Update frontend/vite.config.ts

2026-03-02 15:13:36 -05:00