Mehboob Khan
28d0addfc0
Some checks failed
CI / build (push) Has been cancelled
Fixes the two High-severity findings from Isaac Hague's 19/08/2026 review (F-01, F-02) plus F-03 through F-09: - F-01: content writes are now sanitised server-side (sanitize-html) as the real security boundary — the browser-side sanitiser is UX, not enforcement, and a direct API write bypassed it entirely. Also closes the javascript: href gap in sanitiseInline(). - F-02: refusing the factory admin password no longer depends on NODE_ENV; it's the unconditional default now, with an explicit ALLOW_DEV_PASSWORD=1 opt-in for local dev. - F-03: adds CSP (report-only — the legacy inline onclick="" handlers would break under enforcement) and HSTS, in both server/index.mjs and vercel.json. - F-04/F-05: rate-limits /api/leads and rotates leads.jsonl past 5MB; CSV export neutralises leading =+-@ so exports can't carry live formulas. - F-06: sessions drop from 12h to 4h and are tied to a per-boot random epoch, so a restart now actually revokes outstanding tokens. - F-07/F-08/F-09: generic messages on 5xx, fixed-length password comparison (no more length disclosure via the short-circuit), periodic throttle-map cleanup. F-10 (dependency advisories): applied the two non-breaking patches (nanoid, postcss); the vite/react-router-dom major bumps are left for a separate pass, per the report's own recommendation. F-11 (PDF Content-Disposition) and a CAPTCHA/honeypot on the enquiry form are deliberately left open — both are product/UX calls, not pure security fixes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
33 lines
1.3 KiB
Plaintext
33 lines
1.3 KiB
Plaintext
# Copy to .env and fill in before deploying. server/index.mjs reads these from
|
|
# the real process environment — see docs/DEPLOYMENT.md for how to set them on
|
|
# your host (systemd, Docker, IIS, etc.). A .env file is NOT loaded automatically
|
|
# by the server; it's documentation of what to set, not a config loader.
|
|
|
|
# Password for /admin (BlackDice Studio). REQUIRED — the server refuses to
|
|
# start without it (or with the factory password "blackdice"). For local
|
|
# development only, set ALLOW_DEV_PASSWORD=1 below instead of setting this.
|
|
ADMIN_PASSWORD=
|
|
|
|
# Local development only: accept the factory password "blackdice" instead of
|
|
# requiring ADMIN_PASSWORD. Never set this in a real deployment.
|
|
ALLOW_DEV_PASSWORD=
|
|
|
|
# Signs admin session tokens. Optional — defaults to a hash derived from
|
|
# ADMIN_PASSWORD. Set it separately if you want to be able to invalidate all
|
|
# sessions without changing the password.
|
|
ADMIN_SECRET=
|
|
|
|
# Port the server listens on. Default: 8787
|
|
PORT=8787
|
|
|
|
# Where published content, uploads and enquiry leads are stored.
|
|
# Put this on persistent storage — it's the one thing that can't be rebuilt
|
|
# from git. Default: ./content
|
|
CONTENT_DIR=
|
|
|
|
# The built site to serve. Default: ./dist
|
|
DIST_DIR=
|
|
|
|
# Canonical origin used in sitemap.xml and absolute meta URLs.
|
|
SITE_URL=https://www.blackdice.ai
|