leetcrypt e7bacc93da fix(security): comprehensive security hardening — TLS, HMAC WS auth, rate limiting, IP leak prevention ... CRITICAL fixes: - Auto-generated self-signed TLS certs (HTTPS/WSS by default) - Removed session_key from /srp/verify response (was sent in plaintext) - Replaced with HMAC-SHA256 ws_token for WebSocket authentication HIGH fixes: - WebSocket auth now validates ws_token via hmac.compare_digest() - /clear endpoint requires Bearer admin_token (printed at server start) - Password no longer required as CLI arg — supports env var + getpass prompt - Removed user_ip from Message model (no longer broadcast to clients) MEDIUM fixes: - Rate limiter on /srp/init and /srp/verify (10 req/min/IP) - MessageStore capped at 1000 messages (prevents RAM DoS) - access_log disabled (was leaking request metadata) LOW fixes: - Username sanitization against rich markup injection - Dead code removed from helpers.py All 79 tests passing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-05-25 20:30:40 -07:00
..
client	fix(security): comprehensive security hardening — TLS, HMAC WS auth, rate limiting, IP leak prevention	2026-05-25 20:30:40 -07:00
server	fix(security): comprehensive security hardening — TLS, HMAC WS auth, rate limiting, IP leak prevention	2026-05-25 20:30:40 -07:00
__init__.py	fix(security): comprehensive security hardening — TLS, HMAC WS auth, rate limiting, IP leak prevention	2026-05-25 20:30:40 -07:00