olsch01 fb20c917e1 feat(security): address findings from v2 security assessment ...

- L2: Add server_tokens off to nginx configs to hide version
- M1: Add X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
  Permissions-Policy headers to all nginx routes
- L3: Add global NoCacheInterceptor (Cache-Control: no-store) on all
  API responses to prevent caching of sensitive financial data
- C1: Disable open registration by default (ALLOW_OPEN_REGISTRATION env)
- H3: Add logout endpoint with correct HTTP 200 status code
- M2: Implement full password reset flow (forgot-password, reset-password,
  change-password) with hashed tokens, 15-min expiry, single-use
- Reduce JWT access token expiry from 24h to 1h
- Add EmailService stub (logs to shared.email_log)
- Add DB migration 016 for password_reset_tokens table

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-17 07:38:48 -04:00

..

init

Phase 6: Expand market rates and enhance AI investment recommendations

2026-02-26 13:39:53 -05:00

migrations

feat(security): address findings from v2 security assessment

2026-03-17 07:38:48 -04:00

seed

feat: add flexible billing frequency support for invoices

2026-03-07 12:01:57 -05:00