Devv 66de404db6 fix(server): reduce JWT expiry to 72h and use UUIDv4 for attachment IDs ...

JWT tokens were valid for 30 days, giving stolen tokens a long attack
window. Reduced to 72 hours per security audit LOW-2.

Attachment IDs used UUIDv7 which embeds millisecond timestamps, allowing
attackers to narrow the UUID search space. Switched to UUIDv4 (fully
random) per security audit LOW-3.

LOW-1 (WebSocket CORS wildcard) was already resolved — checkOrigin
validates against an allowlist.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-14 11:03:25 +08:00

..

cmd

fix(cli): redirect to web onboarding when new user has no workspaces (#903)

2026-04-14 02:04:53 +08:00

internal

fix(server): reduce JWT expiry to 72h and use UUIDv4 for attachment IDs

2026-04-14 11:03:25 +08:00

migrations

feat(search): add project search support to Cmd+K search (#663)

2026-04-10 20:59:32 +08:00

pkg

Merge pull request #755 from sanjay3290/feat/gemini-backend

2026-04-14 02:46:20 +08:00

go.mod

fix: sanitize markdown rendering in comments and shared renderers (#679)

2026-04-11 03:44:30 +08:00

go.sum

fix: sanitize markdown rendering in comments and shared renderers (#679)

2026-04-11 03:44:30 +08:00

sqlc.yaml

…