feat: auditoría de seguridad en APIs, deuda Next 16 y pnpm como gestor

Browse Source

Cierra autenticación en /api/deployer, POST /api/modules, /api/stats y /verify (assertIT + validación de slugs/nombres). GET /api/modules público sanitizado (solo visibles, sin repoUrl ni logs). Corrige estado unhealthy, XSS en plantillas, open redirect en login. Sesión HMAC en tiempo constante, secret obligatorio, 503 si el backend cae, cookie secure solo en prod. Migra middleware a proxy, rate-limit en login, vitest + typecheck, Tailwind/CDN fuera, Boxicons local, polling pausado y código muerto eliminado. Estandariza pnpm (lock, Dockerfile, packageManager).

...

This commit is contained in:

Nurfog committed 2026-10-08 10:29:13 -03:00

1 parent ba71c4daa6

commit 8f30b1c1ec

27 files changed

+5708 -7328

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pnpm-lock.yaml

Generated

+5132

File diff suppressed because it is too large. Load diff