H5 (traceback leak, completing the prior log-level fix): new app/utils/security.py
safe_traceback() logs the full stack server-side and returns it to clients only when
FLASK_DEBUG; all 53 traceback.format_exc() in api/{graph,report,simulation}.py now call
it (import traceback removed).
Upload content sniff: upload_content_ok() magic-byte check — pdf must start %PDF-,
txt/md/markdown rejected if they contain NUL bytes (BOM-prefixed UTF-16/32/8 text
allowed). Wired into the graph.py upload loop so a renamed binary can't pass the
extension whitelist.
Path validation: validate_id() (^[A-Za-z0-9_-]{1,64}$) blocks traversal before every
id->filesystem sink — ProjectManager._get_project_dir, SimulationManager._get_simulation_dir,
ReportManager._get_report_folder + the two Report*Logger __init__, and a new
SimulationRunner._run_dir() that all RUN_STATE_DIR joins route through.
CSP / security headers: CSP <meta> in index.html, vite preview.headers
(X-Frame-Options/nosniff/Referrer-Policy + CSP frame-ancestors), and a Flask
after_request that sets the same headers on API responses.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Deleted the backend README.md file as it was no longer needed.
- Changed the favicon from a SVG to a PNG format for better compatibility.
- Updated the page title in index.html to reflect a more concise branding message.
- Updated `index.html` to include Google Fonts for improved typography.
- Refactored `App.vue` to utilize new font styles and added a white background for better contrast.
- Redesigned `Home.vue` to introduce a navigation bar, a hero section with a new logo, and a structured dashboard layout for project simulation steps.
- Added a new logo image `MiroFish_logo_left.jpeg` to enhance branding.
- Improved overall styling and responsiveness across components for a more cohesive user experience.
- Introduced `PROJECT_STATUS.md` to provide a comprehensive overview of the MiroFish project, detailing the current status, completed features, and future development plans.
- Added multiple documentation files in the frontend directory, including detailed descriptions of the homepage functionality, startup guide, and project completion summary.
- Implemented a structured approach to document the project's architecture, API integration, and user interaction processes, enhancing clarity for developers and users alike.
- Included a `.gitignore` file to manage ignored files and directories in the frontend project, improving project organization and cleanliness.
Yo-LRK
ghostubborn
666ghj