simone bcff4aad48 docs(security): slug cliente ruotati in produzione ...

I 4 slug esistenti avevano suffissi da 4 caratteri generati con Math.random();
ora 12 caratteri CSPRNG. Lo slug risolve prima del token, quindi era il vero
anello debole dell'accesso alla dashboard cliente (C-2).

Lo script SQL NON e' committato di proposito: contiene gli slug in chiaro, che
sono credenziali bearer verso /client/<slug> — committarlo ripeterebbe la fuga
di credenziali trovata al punto 1 dell'audit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-07-28 10:55:38 +02:00

.claude

feat: pagina Clienti redesign Quiet Luxury — tabella tokenizzata + copia link

2026-07-11 16:32:34 +02:00

.planning

docs(security): slug cliente ruotati in produzione

2026-07-28 10:55:38 +02:00

design-reference

feat: pagina Impostazioni redesign Quiet Luxury — sezioni tokenizzate + PoolManager tassonomie dual-mode

2026-07-12 12:14:52 +02:00

public

chore(01-01): bootstrap Next.js 16 with TypeScript, App Router, Tailwind CSS v4

2026-05-13 15:28:58 +02:00

scripts

feat: service offer tags, catalog cleanup, offer editor filter

2026-06-18 21:58:34 +02:00

src

fix(security): audit completo — secondo gate admin, hardening slug, XSS, CSP/HSTS, update CVE

2026-07-27 23:35:46 +02:00

.dockerignore

infra(04-00): route /c/ → /client/, Dockerfile, Gitea deploy

2026-05-21 16:12:05 +02:00

.env.example

security: full hardening pass — auth guards, rate limiting, headers, internal secret

2026-05-22 14:36:16 +02:00

.gitignore

feat(01-01): install Drizzle ORM, postgres-js, and configure DB client

2026-05-13 15:30:53 +02:00

CLAUDE.md

docs: correct DB-access procedure (direct SSH+docker exec, remote is gitea)

2026-06-23 10:39:45 +02:00

components.json

feat(01-01): install shadcn/ui components and lucide-react icons

2026-05-13 15:32:19 +02:00

Dockerfile

security: full hardening pass — auth guards, rate limiting, headers, internal secret

2026-05-22 14:36:16 +02:00

drizzle.config.ts

feat(01-01): install Drizzle ORM, postgres-js, and configure DB client

2026-05-13 15:30:53 +02:00

eslint.config.mjs

chore(01-01): bootstrap Next.js 16 with TypeScript, App Router, Tailwind CSS v4

2026-05-13 15:28:58 +02:00

next.config.ts

fix(security): audit completo — secondo gate admin, hardening slug, XSS, CSP/HSTS, update CVE

2026-07-27 23:35:46 +02:00

package-lock.json

fix(security): audit completo — secondo gate admin, hardening slug, XSS, CSP/HSTS, update CVE

2026-07-27 23:35:46 +02:00

package.json

fix(security): audit completo — secondo gate admin, hardening slug, XSS, CSP/HSTS, update CVE

2026-07-27 23:35:46 +02:00

postcss.config.mjs

chore(01-01): bootstrap Next.js 16 with TypeScript, App Router, Tailwind CSS v4

2026-05-13 15:28:58 +02:00

STATUS.md

docs: add STATUS.md session handoff

2026-06-22 14:34:17 +02:00

tsconfig.json

chore(01-01): bootstrap Next.js 16 with TypeScript, App Router, Tailwind CSS v4

2026-05-13 15:28:58 +02:00

S

Description

ClientHub portale clienti

5.3 MiB

Languages

TypeScript 80.5%

HTML 18.6%

Shell 0.4%

CSS 0.4%