codebuddy
72cee0e85e
Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env.
21 lines
225 B
Plaintext
21 lines
225 B
Plaintext
# Dependencies
|
|
node_modules/
|
|
frontend-variants/
|
|
|
|
# Build / generated
|
|
*.log
|
|
|
|
# Python helper bytecode
|
|
__pycache__/
|
|
|
|
# Secrets & local state — never commit these.
|
|
.env
|
|
.env.*
|
|
*.db
|
|
*.db-*
|
|
*.key
|
|
*.pem
|
|
*.crt
|
|
*.csr
|
|
backend/data/
|