umputun / stash / 19622037683

83%

push

github

fix(auth): address security review findings

- mask tokens in debug logs to prevent credential exposure
- add startup warning when tokens provided without password-hash
- use configured loginTTL for cookie MaxAge instead of hardcoded 24h
- reorder middleware so RealIP runs before Throttle for correct rate limiting

6 of 16 new or added lines in 3 files covered. (37.5%)

632 of 1073 relevant lines covered (58.9%)

6.28 hits per line