watchgether-api

T

Whykioh 42a388cbe1 Harden for public launch: rate limiting, CORS, error display, Gitea webhook sig

- User::login() locks an account for 15 min after 5 failed attempts
- CORS now restricted to an explicit origin whitelist instead of *
- display_errors disabled in production (errors still logged server-side)
- webhook.php now checks Gitea's actual signature header (X-Gitea-Signature,
  raw hex) instead of GitHub's format, which never matched on this Gitea instance

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-12 17:53:28 +02:00

config

Fix crash bugs and secure webhook/TMDB key

2026-07-12 16:54:40 +02:00

controllers

Fix crash bugs and secure webhook/TMDB key

2026-07-12 16:54:40 +02:00

models

Harden for public launch: rate limiting, CORS, error display, Gitea webhook sig

2026-07-12 17:53:28 +02:00

utils

Add JWT to enhance security