a7a1595cbf
- make quick/check/mutation from cj/security-baseline (Makefile unchanged, settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint security rules, Forgejo workflow - tests/security: generic baseline tests plus app config and role tests against createApp() with an in-memory database - extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests - fix gaps found by the tests: reject unknown fields on project create, answer malformed JSON with 400 instead of 500, set nosniff on the API - npm audit fix (next 16.4.1 and others, no high/critical left) - clear ESLint errors, safeFileName without control-character regex - per-project ownership stays an open, documented gap (idorGap -> TODO) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 lines
293 B
Text
17 lines
293 B
Text
node_modules/
|
|
dist/
|
|
.next/
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
# Streuprodukt von tsc; drizzle-kit liest drizzle.config.ts.
|
|
/drizzle.config.js
|
|
data/*.db
|
|
data/backups/*.db
|
|
.codex/*.log
|
|
/docs/spec/kbp-Stromkreis.xlsx
|
|
/data/revit-reference/*.xlsx
|
|
# Test- & Security-Baseline
|
|
.venv-tools/
|
|
reports/
|
|
mutants/
|