[SamRepository25]

Security hardening

Closes the remaining findings from the full CodeForge security audit.

Application

• Escape database-controlled blog JSON-LD before embedding it in a script context.
• Replace hard-coded admin email authorization with database role authorization.
• Scope login lockout to a hashed client IP and make the lockout update atomic.
• Enforce mandatory AAL2 for authenticated admin routes and admin write/session operations.
• Add a dedicated mandatory MFA setup route.
• Add backup TOTP factor enrollment and factor selection during MFA login.
• Remove the nonfunctional custom recovery-code implementation.
• Use CSPRNG for guest visitor identifiers.
• Validate Turnstile action and deployment hostname.
• Bind Turnstile widgets to explicit actions.
• Make contact-message rate limiting atomic.
• Keep sensitive admin reads behind the MFA-aware gate.

Database

• Explicitly remove the legacy guest-comment INSERT policy.
• Add atomic contact submission RPC.
• Harden login lockout functions and privileges.
• Require AAL2 for admin write authorization.
• Require AAL2 for admin device/session functions.
• Gate sensitive admin reads with the same authorization function.
• Remove the obsolete custom recovery-code table.
• Expand security regression tests.

CI

• Add GitHub Actions checks for install, lint, build, and high-severity npm audit.

The branch is based directly on current main and does not modify unrelated application features.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
codeforgedev	Ready	Preview	Sep 22, 2026 2:33pm UTC