3 commits

Author	SHA1	Message	Date
cclohmar	e831fcf617	fix: resolve 7 critical security findings from code review ... CR-1: Path traversal in createReceiptZip — validate image_path is within storage/ CR-2: Missing authz on EditExpense/UpdateExpense — verify event ownership CR-3: OTP timing side-channel — use crypto/subtle.ConstantTimeCompare CR-4: Logout doesn't invalidate session — moved to AuthHandler with Sessions.Delete() CR-5: OTP reuse race condition — mutex lock around validate+delete CR-6: Live credentials on disk — removed .env from disk entirely CR-7: No TLS — documented as expected behind-proxy deployment Additional: - Removed stale github.com/expenseflow import path from auth.go - Made EnvironmentFile optional (prefix with -) so .env is not required - App runs and starts clean without any .env file	2026-05-31 01:50:08 +00:00
cclohmar	e20a484ebc	chore: rename binary from receiptnext to app ... - Binary output changed from 'receiptnext' to 'app' - Release assets renamed to app-linux-amd64 / app-linux-arm64 - install.sh, Makefile, README.md updated to reference 'app' - contrib/receiptnext.service uses /opt/receiptnext/app - Systemd service updated to ExecStart=/opt/receiptnext/app	2026-05-30 15:53:24 +00:00
cclohmar	f50048e833	chore: rename to ReceiptNext + deployment scripts ... - Full rename: module path, imports, directory structure - install.sh: one-command bare-metal deployment - contrib/receiptnext.service: systemd service file - Makefile: build, install, manage service - .gitenv updated to ReceiptNext - New Releases page on git.lohmar.co.uk/cclohmar/ReceiptNext	2026-05-30 14:20:49 +00:00