paste-bin

Go to file

Jarian Cottingham 3ea2ab4258 fix: security hardening — SECRET_KEY, CSRF, rate-limit, headers, Docker, SVG (#7,#8,#9,#10,#11,#12,#13,#14,#15,#18,#21,#25)

Use secrets.token_hex for SECRET_KEY (no hardcoded default).
Add CSRF tokens to forms and cookie.
Rate limit uploads: 10 per 60s per IP.
Add security headers: CSP, X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy.
Block SVG uploads (executable JS risk).
Validate image content via magic bytes.
Atomic file creation with O_EXCL (fixes TOCTOU race).
Increase paste ID from 8→16 hex chars.
Run cleanup_expired every 5min in background thread.
Delete .txt files on paste deletion.
Fix file upload tab (missing name attribute).
Docker: add non-root user, pin dependency versions.

2026-07-04 04:57:15 +00:00

static

Initial commit: PasteBin server (Flask, Docker, gunicorn)

2026-05-06 04:49:23 +00:00

templates

fix: security hardening — SECRET_KEY, CSRF, rate-limit, headers, Docker, SVG (#7,#8,#9,#10,#11,#12,#13,#14,#15,#18,#21,#25)

2026-07-04 04:57:15 +00:00

.dockerignore

Initial commit: PasteBin server (Flask, Docker, gunicorn)

2026-05-06 04:49:23 +00:00

.env.example

Initial commit: PasteBin server (Flask, Docker, gunicorn)