cclohmar e831fcf617 fix: resolve 7 critical security findings from code review ... CR-1: Path traversal in createReceiptZip — validate image_path is within storage/ CR-2: Missing authz on EditExpense/UpdateExpense — verify event ownership CR-3: OTP timing side-channel — use crypto/subtle.ConstantTimeCompare CR-4: Logout doesn't invalidate session — moved to AuthHandler with Sessions.Delete() CR-5: OTP reuse race condition — mutex lock around validate+delete CR-6: Live credentials on disk — removed .env from disk entirely CR-7: No TLS — documented as expected behind-proxy deployment Additional: - Removed stale github.com/expenseflow import path from auth.go - Made EnvironmentFile optional (prefix with -) so .env is not required - App runs and starts clean without any .env file		2026-05-31 01:50:08 +00:00
..
otp.go	fix: resolve 7 critical security findings from code review	2026-05-31 01:50:08 +00:00
session.go	chore: initial commit — ExpenseFlow AI-Powered Expense Tracker	2026-05-29 19:43:30 +00:00