security/fix: comprehensive app hardening, restore OAuth login, and normalize note tags#137

Open

jakharmonika364 wants to merge 9 commits into

Coder-s-OG-s:mainfrom

Ayush-Patel-56:security/fix-all-vulnerabilities

Commits on Jun 6, 2026

security: remove root JS/config.js and strip GROQ_API_KEY from client bundle
jakharmonika364
committed
security: move Groq AI calls to server-side proxy (C4)
jakharmonika364
committed
security: fix mass assignment, error leakage and add input validation (H1-H3, M5)
jakharmonika364
committed
security: add rate limiting, restrict CORS, CSRF protection, harden session (H4, H5, M3, M4)
jakharmonika364
committed
security: sanitize /api/auth/user response - strip googleId, githubId, _id (M1)
jakharmonika364
committed
security: add DOMPurify XSS sanitization for note content and AI output (H6, L2)
jakharmonika364
committed
security: client-side hardening - config parser, error guards, stale comments (L1, L3, L4, M2)
jakharmonika364
committed
fix: restore OAuth sign-in by fixing middleware order and SameSite cookie
jakharmonika364
committed
fix: normalize note tags to array and fix DOMPurify SRI integrity hash
jakharmonika364
committed