All settings (auth credentials, scanner ranges, status_checker interval)
now live in a single .env file via pydantic-settings. config.yml and
config.yml.example are deleted.
- Settings: add auth_username, auth_password_hash, scanner_ranges,
status_checker_interval; add load_overrides()/save_overrides() for
persisting runtime changes to data/scan_config.json
- auth.py: read credentials directly from settings
- scan.py: read ranges/interval from settings; write-back via save_overrides()
- scheduler.py: read interval directly from settings
- main.py: call settings.load_overrides() at startup
- docker-compose.yml: remove config.yml volume mount, add new env vars
- conftest.py: set settings fields directly instead of writing a temp config.yml
C2 - JWT token was stored in localStorage (XSS-accessible):
- Switch Zustand persist storage from localStorage to sessionStorage
- Token is now scoped to the current tab and cleared on browser close
H5 - docker-compose had unsafe SECRET_KEY fallback:
- Replace ${SECRET_KEY:-change_me_in_production} with :? syntax
- Docker Compose now aborts with a clear error if SECRET_KEY is unset
M1 - Login endpoint had timing leak allowing username enumeration:
- Always call verify_password() regardless of username match
- Use hmac.compare_digest() for constant-time username comparison
- Both checks run every time; attacker cannot distinguish wrong
username from wrong password via response timing
Pouzor