lerko d30d1460bd fix(security): phase 2 high-severity hardening ...

- Push heartbeat accepts Authorization: Bearer header (query string deprecated)
- Gotify alerts use X-Gotify-Key header instead of token in URL
- Per-IP rate limiting on all API endpoints (token-bucket)
- /metrics gated behind cluster secret (UPTOP_METRICS_PUBLIC=true to opt out)
- Config export redacts passwords/tokens by default (redact_secrets=false to override)
- Fix rewritePlaceholders for 100+ SQL parameters
- Fix AddSiteReturningID/AddAlertReturningID race with LastInsertId/RETURNING
- HTTP server timeouts: read 30s, write 60s, idle 120s

2026-05-25 21:15:33 -04:00

..

alert_test.go

fix(security): phase 1 critical fixes for public release

2026-05-25 11:26:47 -04:00

alert.go

fix(security): phase 2 high-severity hardening

2026-05-25 21:15:33 -04:00