James 03b75e8a7b Security audit 2026-02-28: fix critical/high findings ... CRITICAL fixes: - OTP code comparison now uses constant-time compare (timing attack) - Backdoor code comparison now uses constant-time compare (timing attack) HIGH fixes: - CORS policy restricted to allowlist (was wildcard *) - Added security headers middleware (X-Frame-Options, X-Content-Type-Options, CSP, etc.) See docs/SECURITY-AUDIT-2026-02-28.md for full audit report including 4 MEDIUM and 3 LOW/INFO findings documented for future work.		2026-02-28 07:17:06 -05:00
..
chat.go	Switch Aria chatbot from Anthropic to Fireworks (llama-v3p3-70b)	2026-02-28 04:55:32 -05:00
handlers.go	Security audit 2026-02-28: fix critical/high findings	2026-02-28 07:17:06 -05:00
integration_test.go	chore: auto-commit uncommitted changes	2026-02-28 06:01:21 -05:00
middleware.go	Security audit 2026-02-28: fix critical/high findings	2026-02-28 07:17:06 -05:00
middleware_test.go	Security audit 2026-02-28: fix critical/high findings	2026-02-28 07:17:06 -05:00
routes.go	Security audit 2026-02-28: fix critical/high findings	2026-02-28 07:17:06 -05:00