Yo-LRK 394638d426 security: address HIGH findings (stored XSS, wildcard CORS, prod log leak) ... H1 — stored XSS via v-html / innerHTML of unsanitized LLM/agent/interview/report content: add DOMPurify; both renderMarkdown() now return DOMPurify.sanitize(html) (Step4Report.vue, Step5Interaction.vue), and the formatAnswer innerHTML sink is wrapped in DOMPurify.sanitize. All 8 HTML-injection sinks now sanitized; markdown rendering preserved (DOMPurify secure defaults keep the md-* tags/classes). H4 — wildcard CORS: CORS origins now Config.ALLOWED_ORIGINS (comma-separated env, default localhost:3000) instead of '*'. H5 — request bodies written to disk in cleartext: logger file level now follows FLASK_DEBUG (INFO in prod), so the before_request body-debug log is suppressed in production. (traceback-in-response across 53 handlers deferred to a separate refactor.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-06-13 17:32:36 +07:00
..
app	security: address HIGH findings (stored XSS, wildcard CORS, prod log leak)	2026-06-13 17:32:36 +07:00
scripts	security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline)	2026-06-13 17:19:05 +07:00
pyproject.toml	security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline)	2026-06-13 17:19:05 +07:00
requirements.txt	security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline)	2026-06-13 17:19:05 +07:00
run.py	Add UTF-8 encoding support for Windows console in run.py and logger.py to prevent character encoding issues	2025-12-26 17:58:48 +08:00
uv.lock	security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline)	2026-06-13 17:19:05 +07:00