External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden rate limits, Redis auth, resource caps, and error sanitization

Browse Source 
- Lower LOGIN_ATTEMPT_LIMIT default from 30 to 10 (brute-force protection)
- Lower RATE_LIMIT_PER_MIN default from 1000 to 300
- Add Redis authentication (requirepass) with REDIS_PASSWORD env var
- Add Redis maxmemory 512mb cap to prevent unbounded growth
- Add mem_limit: 1g to Postgres and Redis containers
- Strip internal file paths from all error responses (defense-in-depth)
- Add startup warnings for default admin/Postgres/Redis credentials
- Update security test expectations for new defaults
This commit is contained in:
SnapOtter
2026-06-20 00:53:11 +08:00
parent b847dcc2ab
commit d61226496b
6 changed files with 42 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/security-auth-hardening.test.ts
+2 -2
View File
@@ -26,9 +26,9 @@ import {
// ── Env defaults ─────────────────────────────────────────────────────────────
describe("Security: env defaults", () => {
it("LOGIN_ATTEMPT_LIMIT defaults to 30", () => {
it("LOGIN_ATTEMPT_LIMIT defaults to 10", () => {
const env = loadEnv();
expect(env.LOGIN_ATTEMPT_LIMIT).toBe(30);
expect(env.LOGIN_ATTEMPT_LIMIT).toBe(10);
});
it("RATE_LIMIT_PER_MIN is parsed correctly (test env overrides to 10000)", () => {