marscoin / martianrepublic / 23750714281

11%

Build Type

push

github

Committed by Martian Congress

Commit Message

security: Sprint 1 — comprehensive security hardening (S1–S14)

S1:  Command injection — replaced shell_exec with Process facade
     in BlockDisplay, BlockIntervalSparkline, LegislationRepo
S2:  XSS — removed addslashes(), use json_encode for JS contexts,
     strip_tags on markdown, escaped feed display messages
S3:  Input validation — added FormRequest classes for Congress
     amendments, tier challenges, and ballot key storage
S4:  Ballot encryption — encrypted_key/encryption_iv now use
     Laravel's encrypted cast (encrypted at rest with APP_KEY)
S6:  Rate limiting — throttle on AI chat (20/m), forum posts
     (5-10/m), contact form (3/m)
S7:  2FA brute-force — 5 failed attempts triggers 15min lockout
S8:  Token expiry — Sanctum tokens expire after 24 hours
S10: Log level — production changed from debug to warning
S13: HSTS preload — added preload directive
S14: CI hardened — composer audit now fails build on vulnerabilities

79 tests passing, 0 PHPStan errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

1 of 75 new or added lines in 9 files covered. (1.33%)

9 existing lines in 4 files now uncovered.

445 of 5297 relevant lines covered (8.4%)

1.06 hits per line