mporwoll/cms.c2sgmbh
1
0
Fork 0
mirror of https://github.com/complexcaresolutions/cms.c2sgmbh.git synced 2026-03-17 18:34:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
cms.c2sgmbh/docs
History
Martin Porwoll fc94531931 feat: implement security hardening module 
Security Features:
- Central rate-limiter service with Redis support and memory fallback
  - Predefined limiters: publicApi, auth, email, search, form, strict
  - Automatic cleanup of stale entries
- IP allowlist/blocklist for sensitive endpoints
  - CIDR and wildcard support
  - Configurable via SEND_EMAIL_ALLOWED_IPS, BLOCKED_IPS env vars
- CSRF protection with Double Submit Cookie pattern
  - Token endpoint: GET /api/csrf-token
  - Origin header validation
- Data masking service for sensitive data
  - Automatic redaction of passwords, tokens, API keys
  - Safe logger factory for consistent logging
  - Recursive object masking for audit logs

Secret Scanning:
- Pre-commit hook for local secret detection
- GitHub Actions workflow with Gitleaks and CodeQL
- Gitleaks configuration file
- Dependency vulnerability scanning

Updated:
- /api/send-email now uses central rate-limiter and IP allowlist
- Redis lib exports getRedisClient and isRedisAvailable

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-07 23:04:14 +00:00
..
anleitungen feat: implement security hardening module 2025-12-07 23:04:14 +00:00
CLAUDE_PAYLOAD_CMS.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
IMPLEMENTIERUNGS-AUFTRAG.md feat: implement multi-tenant email system with logging 2025-12-07 20:16:54 +00:00
INFRASTRUCTURE.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
PROJECT_STATUS.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
Prompt phase2 blocks.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
PROMPT_CONSENT_PAYLOAD.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
PROMPT_PAYLOAD_API_CONFIG.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
PROMPT_PHASE1_COLLECTIONS.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
PROMPT_PHASE4_CONTENT_MIGRATION.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
PROMPT_PRIVACY_POLICY_PAYLOAD.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
PROMPT_UNIVERSAL_FEATURES_PAYLOAD.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00
SECURITY_FIXES.md test: add E2E and integration tests with documentation 2025-12-01 08:19:52 +00:00