canglan 880e3905dc fix: CSP scriptSrcAttr explicitly allow unsafe-inline

2026-07-15 04:39:23 +08:00

..

middleware

docs: README + optimize auth getSecret, features id fix, token error msg

2026-07-14 03:19:36 +08:00

routes

fix: only two sources (netease/skin), plugin uses skin

2026-07-15 04:36:01 +08:00

db.js

fix: only two sources (netease/skin), plugin uses skin

2026-07-15 04:36:01 +08:00

mailer.js

fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook

2026-07-13 03:49:02 +08:00

server.js

fix: CSP scriptSrcAttr explicitly allow unsafe-inline

2026-07-15 04:39:23 +08:00

webhook.js

security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy

2026-07-13 19:49:44 +08:00