adamp
39b2ce73da
- Use timing-safe comparisons for HMAC verification and password checks - Add login rate limiting (5 attempts/minute per IP) - Lock down CORS to Vite dev origin only (not needed in production) - Derive signing key from APP_PASSWORD instead of using it directly - Replace hand-rolled cookie parsing with cookie-parser middleware - Wrap all order mutations in SQLite transactions - Fix TOCTOU race on stock with atomic UPDATE...WHERE quantity >= ? - Fix APP_SECERT typo in .env (gitignored, local fix only) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
22 lines
536 B
JSON
22 lines
536 B
JSON
{
|
|
"name": "girl-scout-cookies",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "concurrently \"npm run server\" \"npm run client\"",
|
|
"server": "node server/index.js",
|
|
"client": "cd client && npm run dev",
|
|
"build": "cd client && npm run build",
|
|
"start": "NODE_ENV=production node server/index.js"
|
|
},
|
|
"dependencies": {
|
|
"better-sqlite3": "^11.6.0",
|
|
"cookie-parser": "^1.4.7",
|
|
"cors": "^2.8.5",
|
|
"dotenv": "^16.4.5",
|
|
"express": "^4.21.1"
|
|
},
|
|
"devDependencies": {
|
|
"concurrently": "^9.1.0"
|
|
}
|
|
}
|