Enhance security features and improve error handling - #9

Merged

PhoenixMaster123 merged 8 commits into

mainfrom

feat/security-hardening

Aug 20, 2026

Commits on Aug 20, 2026

fix: report a rejected sign-in as bad credentials, not an expired session
PhoenixMaster123
committed
10d6be0
fix: generate an admin password when none is set, and let configuration reset it
PhoenixMaster123
committed
65ebd24
feat: lock an account out after repeated failed sign-ins
PhoenixMaster123
committed
5e17e75
feat: let signing out revoke a token instead of only forgetting it
PhoenixMaster123
committed
3ade6ad
feat: send a content security policy, HSTS and a referrer policy
PhoenixMaster123
committed
a418011
fix: answer unknown paths with 404, and stop echoing exception text to callers
PhoenixMaster123
committed
b59db5e
feat: disable Swagger by default, trust proxy headers, warn on the dev profile
PhoenixMaster123
committed
645095c
test: cover lockout, revocation and headers; restore the admin between tests
PhoenixMaster123
committed
d4d252d