Jarian Cottingham
afedb6e9ba
- #8: Remove hardcoded credentials, require env vars (YK_ROOT_PIN, YK_INT_PIN, ADMIN_PASSWORD, JWT_SECRET) - #11: JWT secret now random via secrets.token_hex(32) if not set - #12: Admin password from env var, not hardcoded - #14: XSS prevention - sanitize error messages, html.escape - #15: CSRF tokens on all forms - #16: Cookie Secure flag added - #7: datetime.utcnow() → datetime.now(timezone.utc) - #3: Temp files in tempfile.mkdtemp, cleaned after use - #22: Private keys via cryptography library (NoEncryption for now) - #26: DER construction via cryptography library - #27: CRL table added for certificate revocation - #29: WAL autocheckpoint enabled - #30: Caddyfile already has TLS (no change needed) - #6: .gitignore for .password, *.pem, *.key