Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
codebuddy
72cee0e85e