shinchan-zhai
|
1d0d6f7afd
|
security: sanitize internal error messages in API responses
- handler_trader.go: remove loadErr.Error() from 500 responses (2 instances)
- handler_ai_cost.go: replace err.Error() with generic message, add logging
- Internal errors now logged server-side, not exposed to clients
|
2026-03-23 10:46:22 +08:00 |
|
shinchan-zhai
|
ef438b4240
|
docs: update nofxi-tasks.md — record complete panic recovery coverage
|
2026-03-23 10:30:32 +08:00 |
|
shinchan-zhai
|
07b4f30b85
|
docs: update nofxi-tasks.md — record 10:07 batch progress
|
2026-03-23 10:15:41 +08:00 |
|
shinchan-zhai
|
cbf78e6b88
|
docs: update nofxi-tasks.md — mark completed, clean false positives
|
2026-03-23 09:54:53 +08:00 |
|
shinchan-zhai
|
f26a69d222
|
security: configurable CORS origins, limit sentinel response body
- Add CORS_ALLOWED_ORIGINS config (comma-separated origins, default allow-all)
- CORS middleware now validates Origin header against allowlist
- Add io.LimitReader to sentinel.go (was unbounded, now 256KB)
- Include previous: agent chat auth middleware + frontend token header
|
2026-03-23 09:53:49 +08:00 |
|