derekc and Claude Opus 5.5
eed5a8fb12
Fix LOW findings from 2026-09-24 maintenance review
...
- Frontend on nginx-unprivileged (non-root, container port 8080)
- Replace unmaintained passlib with bcrypt 5.0.0 (hash-compatible)
- Pass DOCS_ENABLED through to the backend container
- Raise db mem_limit to 768m for MySQL 8.4
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-09-25 00:01:44 -07:00
derekc and Claude Opus 5.5
3170c7f4eb
Fix HIGH findings from 2026-09-24 maintenance review
...
- nginx: resolve real client IP through Cloudflare -> NPM so rate limits
are per client instead of shared across all users
- Bump vulnerable Python deps (PyJWT auth bypass, anyio, starlette via
fastapi 0.141.1, cryptography, python-multipart, Mako); pin PyMySQL
1.1.2 since 1.2.x breaks SQLAlchemy 2.0.35's aiomysql ping
- Backend: python 3.12.14-slim, apt-get upgrade, drop unneeded build deps
- Frontend: nginx 1.30.5-alpine (stable) + apk upgrade
- MySQL 8.0.40 (EOL) -> 8.4.11 LTS; add healthcheck start_period so
slow startups (e.g. data upgrades) don't abort dependent services
- Add maintenance review report
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-09-24 23:38:16 -07:00
derekc and Claude Sonnet 4.6
3022bc328b
Security hardening: go-live review fixes
...
- TV tokens upgraded from 4 to 6 digits; Regen Token button in Admin
- Nginx rate limiting on TV dashboard and WebSocket endpoints
- Login lockout after 5 failed attempts (15 min); clears on admin password reset
- HSTS header added; CSP unsafe-inline removed from script-src; CORS restricted to explicit methods/headers
- Dependency CVE fixes: PyJWT 2.12.0, aiomysql 0.3.0, cryptography 46.0.5, python-multipart 0.0.22
- datetime.utcnow() replaced with datetime.now(timezone.utc) throughout
- SQL identifier whitelist for startup migration queries
- README updated: security notes section, lockout docs, token regen, NPM proxy guidance
Co-Authored-By: Claude Sonnet 4.6 <[email protected]
2026-03-22 00:00:14 -07:00
derekc and Claude Sonnet 4.6
417b3adfe8
Initial project scaffold
...
Full-stack homeschool web app with FastAPI backend, Vue 3 frontend,
MySQL database, and Docker Compose orchestration. Includes JWT auth,
WebSocket real-time TV dashboard, schedule builder, activity logging,
and multi-child support.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]
2026-02-27 22:56:56 -08:00
derekcandClaude Opus 5.5