paste-bin

jarianc/paste-bin

Fork 0

Commit Graph

Author	SHA1	Message	Date
Jarian Cottingham	3bc5c16c5d	fix: HSTS (#29 ), CSP (#30 ), server version (#34 ), favicon (#35 ), aria (#36,#37), cleanup loop (#1 ), startup dirs (#16 ), health check (#27 ), docker-compose (#19,#20) - Add HSTS, CSP headers, remove Server header, fix GIF magic tuple - Add ARIA landmarks, button labels, inline SVG favicon - Scheduled cleanup loop (every 5min), /health endpoint - Remove docker-compose version field, unused named volumes - Move ensure_dirs to startup, remove duplicate definitions	2026-07-05 04:32:07 +00:00
Jarian Cottingham	3ea2ab4258	fix: security hardening — SECRET_KEY, CSRF, rate-limit, headers, Docker, SVG (#7,#8,#9,#10,#11,#12,#13,#14,#15,#18,#21,#25) Use secrets.token_hex for SECRET_KEY (no hardcoded default). Add CSRF tokens to forms and cookie. Rate limit uploads: 10 per 60s per IP. Add security headers: CSP, X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy. Block SVG uploads (executable JS risk). Validate image content via magic bytes. Atomic file creation with O_EXCL (fixes TOCTOU race). Increase paste ID from 8→16 hex chars. Run cleanup_expired every 5min in background thread. Delete .txt files on paste deletion. Fix file upload tab (missing name attribute). Docker: add non-root user, pin dependency versions.	2026-07-04 04:57:15 +00:00
Jarian Cottingham	016914c6ca	Initial commit: PasteBin server (Flask, Docker, gunicorn)	2026-05-06 04:49:23 +00:00

Author

SHA1

Message

Date

Jarian Cottingham

3bc5c16c5d

fix: HSTS (#29 ), CSP (#30 ), server version (#34 ), favicon (#35 ), aria (#36,#37), cleanup loop (#1 ), startup dirs (#16 ), health check (#27 ), docker-compose (#19,#20)

- Add HSTS, CSP headers, remove Server header, fix GIF magic tuple
- Add ARIA landmarks, button labels, inline SVG favicon
- Scheduled cleanup loop (every 5min), /health endpoint
- Remove docker-compose version field, unused named volumes
- Move ensure_dirs to startup, remove duplicate definitions

2026-07-05 04:32:07 +00:00

Jarian Cottingham

3ea2ab4258

fix: security hardening — SECRET_KEY, CSRF, rate-limit, headers, Docker, SVG (#7,#8,#9,#10,#11,#12,#13,#14,#15,#18,#21,#25)

Use secrets.token_hex for SECRET_KEY (no hardcoded default).
Add CSRF tokens to forms and cookie.
Rate limit uploads: 10 per 60s per IP.
Add security headers: CSP, X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy.
Block SVG uploads (executable JS risk).
Validate image content via magic bytes.
Atomic file creation with O_EXCL (fixes TOCTOU race).
Increase paste ID from 8→16 hex chars.
Run cleanup_expired every 5min in background thread.
Delete .txt files on paste deletion.
Fix file upload tab (missing name attribute).
Docker: add non-root user, pin dependency versions.

2026-07-04 04:57:15 +00:00

Jarian Cottingham

016914c6ca

Initial commit: PasteBin server (Flask, Docker, gunicorn)

2026-05-06 04:49:23 +00:00

3 Commits