1. Password reset tokens: use crypto/rand instead of math/rand 2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies 3. Cleanup: purge failed login attempts older than 24 hours 4. JWT secret: validate minimum 32 character length on startup Updated .env.example with TRUSTED_PROXIES setting |
||
|---|---|---|
| .. | ||
| email.go | ||
| logs.go | ||
| queue.go | ||
| quota.go | ||