Jonathan Kirkwood 3c7094241c 0.2.41: contain SPA static serving to the web root ...

Percent-encoded traversal (..%2f) survived routing and let an
unauthenticated request read files outside static/, including the
database and session secret on the data volume. Paths are now resolved
and contained to the frontend build directory; anything that escapes
falls back to index.html.

2026-08-10 15:38:21 -05:00

..

routers

0.2.39: bitcoin-denominated view, first-login flow, unfunded + tax center

2026-07-12 13:01:50 +02:00

__init__.py

Issue 1: repo scaffold and project structure

2026-06-07 19:20:02 +00:00

audit.py

Implement adjudicated DO items across backend, frontend, deploy

2026-07-01 13:33:40 -05:00

auth.py

Release 0.2.22: capital chart, Investor View, GP stakes, doc folders

2026-07-01 14:25:50 -05:00

cli.py

0.2.39: bitcoin-denominated view, first-login flow, unfunded + tax center

2026-07-12 13:01:50 +02:00

config.py

0.2.27-0.2.32: LP portal polish, brand palette, default investor logins

2026-07-03 08:40:40 -05:00

database.py

Issue 1: repo scaffold and project structure

2026-06-07 19:20:02 +00:00

db_init.py

Issue 1: repo scaffold and project structure

2026-06-07 19:20:02 +00:00

main.py

0.2.41: contain SPA static serving to the web root

2026-08-10 15:38:21 -05:00

models.py

0.2.39: bitcoin-denominated view, first-login flow, unfunded + tax center

2026-07-12 13:01:50 +02:00

ratelimit.py

0.2.26: security hardening from audit (P2/P3 fixes)

2026-07-01 19:09:27 -05:00

schemas.py

0.2.39: bitcoin-denominated view, first-login flow, unfunded + tax center

2026-07-12 13:01:50 +02:00

storage.py

0.2.26: security hardening from audit (P2/P3 fixes)

2026-07-01 19:09:27 -05:00

totp.py

0.2.38: optional two-factor authentication (authenticator-app TOTP)

2026-07-11 22:08:04 +02:00