Graham McIntie 9ecd01dc8f Security hardening: remaining audit fixes ... - Encrypt session cookies (add encryption_salt to endpoint) - X-Frame-Options: SAMEORIGIN → DENY (match CSP frame-ancestors 'none') - Remove unsafe-eval from CSP script-src - Apply security headers in all environments (not just prod) - Add GraphQL query complexity limit (max 500) via Absinthe.Plug - GraphQL introspection already blocked in prod via plug Closes audit items #6, #7, #12, #13, #14, #16		2026-02-15 12:54:38 -06:00
..
channels	Security fixes: mask credentials in logs/API, fix cookie/CSP/LIKE injection/webhooks	2026-02-15 09:09:04 -06:00
components	Fix tests, credo issues, and Gaiia sync bugs	2026-02-15 11:55:49 -06:00
controllers	fix: allow site_id on device create regardless of use_sites setting	2026-02-15 12:28:06 -06:00
graphql	Fix tests, credo issues, and Gaiia sync bugs	2026-02-15 11:55:49 -06:00
helpers	Dashboard: timezone-aware timestamps, site health as table, remove dead code	2026-02-14 16:07:26 -06:00
live	fix compile warning	2026-02-15 12:38:27 -06:00
plugs	Security hardening: remaining audit fixes	2026-02-15 12:54:38 -06:00
changelog_parser.ex	fix: resolve 500 errors on /activity and /changelog	2026-02-13 19:49:12 -06:00
endpoint.ex	Security hardening: remaining audit fixes	2026-02-15 12:54:38 -06:00
gettext.ex	init	2025-12-21 11:10:43 -06:00
gettext_helpers.ex	feat: migrate email templates to gettext (Phase 2 - Emails)	2026-02-02 09:48:30 -06:00
permissions.ex	i18n: add Spanish locale with full translations, language selector, and locale hook	2026-02-14 17:44:01 -06:00
plug_exceptions.ex	handle exceptions gracefully on api endpoints	2026-02-04 12:18:14 -06:00
router.ex	Security hardening: remaining audit fixes	2026-02-15 12:54:38 -06:00
telemetry.ex	fix: add Oban config to dev.exs and replace Exq telemetry with Oban	2026-01-24 16:39:45 -06:00
user_auth.ex	Security fixes: mask credentials in logs/API, fix cookie/CSP/LIKE injection/webhooks	2026-02-15 09:09:04 -06:00