ga c30faf02ef Sprint 6: security hardening ... 1. CORS whitelist (was '*'): only buhapp.mygoodservice.ru, t.me, web.telegram.org 2. Rate limit on /auth/login (10/min/IP) and /auth/register (5/hour/IP) 3. TGHandler: removed unused JWTSecret, added WebhookSecret, real secret check 4. Login: constant-time bcrypt on user enumeration (dummy hash) 5. TgUsername saved in users (was lost) 6. User.IsVerified=true for Telegram users 7. Register: 409 instead of 500 on duplicate email 8. Bumped version to 0.4.0		2026-08-20 20:42:22 +00:00
..
auth.go	Sprint 6: security hardening	2026-08-20 20:42:22 +00:00
chat.go	Chat edit with WS notification	2026-08-20 15:52:57 +00:00
consent.go	Sprint 6: security hardening	2026-08-20 20:42:22 +00:00
handlers.go	Sprint 5: reviews and ratings	2026-08-20 16:20:15 +00:00
reviews.go	Sprint 5: reviews and ratings	2026-08-20 16:20:15 +00:00
telegram.go	Sprint 6: security hardening	2026-08-20 20:42:22 +00:00