web security audit fixes

2026-06-02 10:30:42 -04:00
parent 36b087ae92
commit ab0d4857db
26 changed files with 1527 additions and 289 deletions
--- a/.env.example
+++ b/.env.example
@@ -7,6 +7,9 @@ PORT=3000
 NODE_ENV="development"
 LOG_LEVEL="info"
 APP_URL="http://localhost:3000"
+# Explicit CORS origin allowlist (comma-separated, validated before use)
+# Overrides/extends APP_URL for CORS. Example: VALID_CORS_ORIGINS="https://app.kordant.com,https://admin.kordant.com"
+VALID_CORS_ORIGINS=""

 # Auth
 JWT_SECRET=""