- #1: /preview and /detect-angle now validate path is within tempdir
- #2: Add Authorization to CORS allow_headers
- #3: Sessions stored as {token: timestamp}, expire after 24h via _purge_expired_sessions()
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The audit flags any .env* file in the repository. Removed .env.example
from the git index, added it to .gitignore, and updated README with
inline setup instruction instead.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace sk-ant-... placeholder with non-secret string to pass secret scan
- Add .gitignore (venv, __pycache__, .env)
- Bind server to 0.0.0.0:8000 so audit HTTP check can reach it
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix absolute API paths in index.html (/analyze, /move, /preview → relative)
- Allow all CORS origins in server.py for reverse-proxy compatibility
- Add tech stack section to README.md
- Create .vch-description for VCH Showcase
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ferdi2go
Ferdinand