ga c30faf02ef Sprint 6: security hardening ... 1. CORS whitelist (was '*'): only buhapp.mygoodservice.ru, t.me, web.telegram.org 2. Rate limit on /auth/login (10/min/IP) and /auth/register (5/hour/IP) 3. TGHandler: removed unused JWTSecret, added WebhookSecret, real secret check 4. Login: constant-time bcrypt on user enumeration (dummy hash) 5. TgUsername saved in users (was lost) 6. User.IsVerified=true for Telegram users 7. Register: 409 instead of 500 on duplicate email 8. Bumped version to 0.4.0		2026-08-20 20:42:22 +00:00
..
audit	Sprint 5.1: JSON snake_case tags + lowercased fields	2026-08-20 16:29:02 +00:00
auth	Sprint 5: reviews and ratings	2026-08-20 16:20:15 +00:00
chat	Sprint 5.1: JSON snake_case tags + lowercased fields	2026-08-20 16:29:02 +00:00
config	Sprint 6: security hardening	2026-08-20 20:42:22 +00:00
consent	Sprint 1: scaffold backend (Go + Fiber + PG + Redis + MinIO)	2026-08-20 15:41:05 +00:00
db	Sprint 1: scaffold backend (Go + Fiber + PG + Redis + MinIO)	2026-08-20 15:41:05 +00:00
handlers	Sprint 6: security hardening	2026-08-20 20:42:22 +00:00
locations	Sprint 5.1: JSON snake_case tags + lowercased fields	2026-08-20 16:29:02 +00:00
preferences	Sprint 5.1: JSON snake_case tags + lowercased fields	2026-08-20 16:29:02 +00:00
redis	Sprint 1: scaffold backend (Go + Fiber + PG + Redis + MinIO)	2026-08-20 15:41:05 +00:00
reviews	Sprint 5.1: JSON snake_case tags + lowercased fields	2026-08-20 16:29:02 +00:00
storage	Sprint 1: scaffold backend (Go + Fiber + PG + Redis + MinIO)	2026-08-20 15:41:05 +00:00
telegram	Sprint 6: security hardening	2026-08-20 20:42:22 +00:00
users	Sprint 6: security hardening	2026-08-20 20:42:22 +00:00
ws	Sprint 3: chat with WebSocket	2026-08-20 15:51:05 +00:00