fix(security): address critical/high/medium audit findings on the write & auth paths - #305

Merged

ety001 merged 7 commits into

nextfrom

security/audit-fixes

Jul 16, 2026

Commits on Jul 16, 2026

fix(security): real server-side signature verification (closes Critical #1)
ety001
committed
test(security): cover new verification, CSRF, rate-limit, cache-invalidate code
ety001
committed
fix(test): remove unused import and NODE_ENV assignment in csrf.test
ety001
committed