4 commits

Author	SHA1	Message	Date
senke	caa5e698aa	fix(security): reject DISABLE_RATE_LIMIT_FOR_TESTS in production (A04)	2026-02-16 10:16:35 +01:00
senke	9c23fefe40	fix(backend): require ClamAV in production environment ... Add validation in ValidateForEnvironment() to fail startup when CLAMAV_REQUIRED=false in production. Virus scanning is mandatory for all file uploads in production. Phase 1 audit - P1.4	2026-02-15 15:54:58 +01:00
senke	efbe6968f9	fix(audit-1.6,1.7): remove hardcoded test secrets, block bypass flags in prod ... - 1.6: Replace hardcoded JWT secrets in chat server tests with runtime-generated values (env TEST_JWT_SECRET or uuid-based fallback) - 1.7: Add validateNoBypassFlagsInProduction() in config; fail startup if BYPASS_CONTENT_CREATOR_ROLE or CSRF_DISABLED is set in production Refs: AUDIT_TECHNIQUE_INTEGRAL_2026_02_15.md items 1.6, 1.7	2026-02-15 14:18:23 +01:00
okinrev	2425c15b09	adding initial backend API (Go)	2025-12-03 20:29:37 +01:00