fix: harden auth, SSRF, query engine, and cookie security

2026-03-18 11:37:33 +04:00
parent d278ab0458
commit 5a0cf5033b
14 changed files with 212 additions and 28 deletions
@@ -1,6 +1,9 @@
 # Web app + coordinator
 DATABASE_URL=postgres://pingql:pingql@localhost:5432/pingql
 MONITOR_TOKEN=changeme-use-a-random-secret
+EMAIL_HMAC_KEY=changeme-use-a-random-secret
+# Set to "false" only for local development without HTTPS
+# COOKIE_SECURE=false

 # Rust monitor
 COORDINATOR_URL=http://localhost:3000