Mattsson 550cadcb06 fix: harden auth, cron secrets, and provider flows (GNU-17) (#148) ...

- Replace === with crypto.timingSafeEqual in all 7 cron routes via shared lib/auth/cron.ts
- Add in-memory rate limiting (60 req/min) and expires_at support to calendar feed
- Add exponential backoff on MFA verify after 3 failed attempts
- Add 60s cooldown on password reset requests
- Validate bank callback auth code format before API call
- Redact session IDs from bank sync and callback logs
- Validate OAuth redirect_uris against allowlist (claude.ai, claude.com, localhost)
- Remove excessive PII/debug console logging from login page

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-29 23:49:09 +02:00

..

route.ts

fix: harden auth, cron secrets, and provider flows (GNU-17) (#148)

2026-03-29 23:49:09 +02:00