- Add block-demo middleware to all authenticated route groups
(settings, web routes, open-banking, api)
- Add rate limiting (throttle:120,1) to API routes
- Add rate limiting (throttle:10,1) to OAuth callback
- Replace trustProxies(at: '*') with env-based TRUSTED_PROXIES config
- Clear state_token on EnableBanking session creation failure
- Move Sentry auth token from hardcoded to SENTRY_AUTH_TOKEN env
- Replace Blade {{ }} with @json() for XSS-safe JS variable injection
- Add limit(500) + has_more flag to TransactionSyncController
- Add since date validation to TransactionSyncController
- Add user_id scoping to Api/TransactionController bulkUpdate
c4af43786b