Graham McIntire 97232117f5 fix: H12 cookie hardening + 5 low/medium bugs (L2, L5, L6, L8, L10, L11) ... - H12: session and remember-me cookies get http_only + secure (prod-only). Cookie can no longer be read via document.cookie (XSS exfil defense) and the Secure flag is set in production via config/prod.exs. - L2: 404 tracker uses EXPIRE … NX so a sustained probe can't keep refreshing the 60s window and dodge the threshold ban. - L5: vault only reads CLOAK_KEY when :env == :prod — a developer with a prod env var set in their shell won't accidentally encrypt local data with the production key. - L6: health endpoint no longer leaks the app version. - L8: Preseem.dismiss_insight/2 + InsightsLive uses it — dismissing now requires the insight to belong to the user's org (closes IDOR). - L10: SidebarCollapse JS hook stores its click handler and removes it in destroyed(); listeners no longer accumulate across LV navigation. - L11: WebMCP navigate tool rejects anything that isn't a same-origin absolute path (blocks javascript:, data:, off-site URLs).		2026-05-12 11:22:47 -05:00
..
index.ex	fix: H12 cookie hardening + 5 low/medium bugs (L2, L5, L6, L8, L10, L11)	2026-05-12 11:22:47 -05:00
index.html.heex	feat(insights): superuser regenerate button + dialyzer cleanup	2026-05-10 13:41:25 -05:00