bvandeusen 00643c778e security: fix 10 vulnerabilities from security audit ...

- SSRF: block private/internal URLs in image cache fetch
- SSRF: block private/internal URLs in RSS feed fetch (scheme guard)
- SSRF: block private/internal URLs in CalDAV URL setting
- Auth: require login for GET /api/images/<id> (was unauthenticated)
- Auth: restrict Ollama model pull/delete to admin users only
- Info disclosure: remove email from /api/users/search response
- OAuth: skip email-based account linking when email_verified is false
- Config: raise hard error on default SECRET_KEY when SECURE_COOKIES=true
- Rate limit: document proxy header requirement; add startup warning
- XSS: remove src/alt from global DOMPurify ADD_ATTR allowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-29 00:37:13 -04:00

..

.gitkeep

Initial commit: note-taking/task-tracking app with LLM integration scaffold

2026-02-09 23:35:44 -05:00

AppHeader.vue

feat: add /news archive view with feed filter and pagination

2026-03-28 00:51:24 -04:00

AppLogo.vue

UI: logo book fill light mode black → indigo

2026-03-10 15:07:00 -04:00

BriefingSetupWizard.vue

refactor: centralise user timezone as a standalone setting

2026-03-25 20:17:51 -04:00

ChatMessage.vue

UI polish: Illuminated Transcript design language

2026-03-10 15:18:22 -04:00

ChatPanel.vue

UI polish pass: word count, slash commands, task lists, graph peek, bulk delete, export

2026-03-07 23:15:01 -05:00

ConfirmDialog.vue

DRY refactoring pass: shared mixins, route helpers, composables, CSS

2026-03-06 15:26:34 -05:00

DashboardChatInput.vue

UX: queue bubbles, dashboard queuing, duplicate confirm buttons, short-note fix

2026-03-09 23:32:21 -04:00

DiffView.vue

Project-aware assist, link suggestions, project-scoped RAG, semantic search tool, SSE race fix

2026-03-06 14:02:54 -05:00

EventSlideOver.vue

fix(calendar): correct event timezone handling

2026-03-25 20:06:09 -04:00

HistoryPanel.vue

UI polish pass: word count, slash commands, task lists, graph peek, bulk delete, export

2026-03-07 23:15:01 -05:00

InlineAssistPanel.vue

Task work log, inline writing assistant, task editor sidebar layout

2026-03-05 13:05:26 -05:00

MarkdownToolbar.vue

UI refinement: toolbar icons, gradient CTA, Fraunces title, viewer polish

2026-03-11 10:57:02 -04:00

MilestoneSelector.vue

Add Projects, Milestones, RAG auto-inject, push notifications, PWA, tag normalisation

2026-03-02 20:52:21 -05:00

NoteCard.vue

UI polish: notes/tasks list views

2026-03-10 22:39:05 -04:00

NotificationBell.vue

Multi-user sharing, groups, and in-app notifications

2026-03-11 15:37:00 -04:00

NotificationsPanel.vue

Multi-user sharing, groups, and in-app notifications

2026-03-11 15:37:00 -04:00

PaginationBar.vue

Add note context visibility in chat and standardize UI design tokens

2026-02-11 06:49:12 -05:00

PriorityBadge.vue

Initial commit: note-taking/task-tracking app with LLM integration scaffold

2026-02-09 23:35:44 -05:00

ProjectSelector.vue

Add Projects, Milestones, RAG auto-inject, push notifications, PWA, tag normalisation

2026-03-02 20:52:21 -05:00

RecurrenceEditor.vue

feat: task management enhancements (cancelled status, recurrence, timestamps)

2026-03-28 00:51:36 -04:00

SearchBar.vue

Add keyboard navigation: e/c/slash shortcuts, j/k list nav, focus visibility

2026-03-04 08:39:49 -05:00

ShareDialog.vue

security: fix 10 vulnerabilities from security audit

2026-03-29 00:37:13 -04:00

StatusBadge.vue

feat: task management enhancements (cancelled status, recurrence, timestamps)

2026-03-28 00:51:36 -04:00

SuggestionDropdown.vue

Add Tiptap inline-preview editor, layout improvements, and README

2026-02-11 21:24:35 -05:00

TableOfContents.vue

Add invitation system, table of contents, actionable dashboard, and settings improvements

2026-02-14 08:46:51 -05:00

TagInput.vue

Keyboard navigation improvements across all editors

2026-03-07 18:46:08 -05:00

TagPill.vue

UI polish: hover lift, skeleton loaders, empty states, badge contrast, transitions

2026-03-10 18:34:52 -04:00

TaskCard.vue

feat: redesign BriefingView into 3-column layout (weather · chat · news)

2026-03-28 00:38:04 -04:00

TaskLogSection.vue

UI polish pass: word count, slash commands, task lists, graph peek, bulk delete, export

2026-03-07 23:15:01 -05:00

TiptapEditor.vue

Upgrade all major frontend dependencies

2026-03-09 21:30:55 -04:00

ToastNotification.vue

UI polish pass: word count, slash commands, task lists, graph peek, bulk delete, export

2026-03-07 23:15:01 -05:00

ToolCallCard.vue

feat: event cards in chat/briefing, upcoming events on dashboard, briefing uses internal store

2026-03-25 15:39:13 -04:00

ToolConfirmCard.vue

Add tool confirmation UI with Accept/Decline for write operations

2026-02-18 20:43:47 -05:00

VersionHistorySection.vue

Move history to sidebar, simplify task assist, add content deduplication

2026-03-11 16:56:30 -04:00

WeatherCard.vue

fix: weather card spacing and sizing consistency

2026-03-26 17:37:27 -04:00

WordCount.vue

UI polish pass: word count, slash commands, task lists, graph peek, bulk delete, export

2026-03-07 23:15:01 -05:00

WorkspaceNoteEditor.vue

Workspace UI overhaul: rail note panel, split task detail, project goal header

2026-03-10 23:51:17 -04:00

WorkspaceTaskPanel.vue

Workspace UI overhaul: rail note panel, split task detail, project goal header

2026-03-10 23:51:17 -04:00