cclohmar a7381bde0c fix: final vulnerability sweep — storage auth, security headers, body limits, cookie flags ... - Storage route moved behind auth middleware (was publicly accessible) - Security headers: X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy - Request body size limit: 10 MB on all endpoints via MaxBytesReader - Session cookie now sets Secure flag when BASE_URL uses HTTPS - readFile() returns proper errors for dirs & oversized files (was nil,nil) - Removed dead DEEPSEEK_API_KEY code from main.go - Added fmt import to ai/receipt.go for error formatting		2026-05-31 02:01:12 +00:00
..
ai	fix: final vulnerability sweep — storage auth, security headers, body limits, cookie flags	2026-05-31 02:01:12 +00:00
auth	fix: resolve 7 critical security findings from code review	2026-05-31 01:50:08 +00:00
database	chore: switch from mattn/go-sqlite3 (CGO) to modernc.org/sqlite (pure Go)	2026-05-30 15:02:07 +00:00
email	feat: send receipt images as ZIP attachment with report	2026-05-30 13:38:23 +00:00
handlers	fix: final vulnerability sweep — storage auth, security headers, body limits, cookie flags	2026-05-31 02:01:12 +00:00
utils	chore: initial commit — ExpenseFlow AI-Powered Expense Tracker	2026-05-29 19:43:30 +00:00