lerko 025b1b61d0 fix(security): strip push tokens from /status/json response ...

The public status JSON endpoint was serializing full Site structs
including heartbeat tokens. An attacker could extract tokens and
forge heartbeats to suppress DOWN alerts. Now tokens are stripped
before encoding. Backup/export endpoint is unaffected.

2026-05-16 15:45:09 -04:00

..

server.go

fix(security): strip push tokens from /status/json response

2026-05-16 15:45:09 -04:00