security: critical fixes from audit

- Rotate 5 exposed production secrets (JWT, ENCRYPTION, ADMIN, POSTGRES, REDIS) - Fix MOCK_PAYMENTS opt-in (now defaults to disabled) - HMAC-SHA256 webhook verification with timing-safe comparison - Purge dangling git blobs (git gc --prune=now) - Rate limiting on auth routes (10/15min per IP) - CORS middleware restricted to falahos.my - Fix walletBalance → flhBalance (Prisma schema mismatch)
2026-06-27 17:54:34 +08:00
parent bfd3509add
commit 0c3521ba4c
8 changed files with 127 additions and 24 deletions
@@ -11,7 +11,7 @@ services:
      - NODE_ENV=production
      - HOSTNAME=0.0.0.0
      - NEXT_PUBLIC_APP_URL=https://falahos.my/mobile-staging
-      - JWT_SECRET=${JWT_SECRET:-flh-staging-jwt-secret}
+      - JWT_SECRET=${JWT_SECRET}
      - DATABASE_URL=file:/app/data/staging.db
      - LLM_API_KEY=${LLM_API_KEY:-}
      - LLM_BASE_URL=${LLM_BASE_URL:-}