cclohmar e831fcf617 fix: resolve 7 critical security findings from code review ... CR-1: Path traversal in createReceiptZip — validate image_path is within storage/ CR-2: Missing authz on EditExpense/UpdateExpense — verify event ownership CR-3: OTP timing side-channel — use crypto/subtle.ConstantTimeCompare CR-4: Logout doesn't invalidate session — moved to AuthHandler with Sessions.Delete() CR-5: OTP reuse race condition — mutex lock around validate+delete CR-6: Live credentials on disk — removed .env from disk entirely CR-7: No TLS — documented as expected behind-proxy deployment Additional: - Removed stale github.com/expenseflow import path from auth.go - Made EnvironmentFile optional (prefix with -) so .env is not required - App runs and starts clean without any .env file		2026-05-31 01:50:08 +00:00
..
ai	fix: remove orphaned fallthrough after ollama removal	2026-05-30 17:40:40 +00:00
auth	fix: resolve 7 critical security findings from code review	2026-05-31 01:50:08 +00:00
database	chore: switch from mattn/go-sqlite3 (CGO) to modernc.org/sqlite (pure Go)	2026-05-30 15:02:07 +00:00
email	feat: send receipt images as ZIP attachment with report	2026-05-30 13:38:23 +00:00
handlers	fix: resolve 7 critical security findings from code review	2026-05-31 01:50:08 +00:00
utils	chore: initial commit — ExpenseFlow AI-Powered Expense Tracker	2026-05-29 19:43:30 +00:00