Repository navigation

Security review fixes: dev stack bind, login throttle, GDPR erasure, practice isolation - #545

Merged

dholbach merged 8 commits into

mainfrom

fix/security-audit-run-1

Oct 28, 2026

Merged

Security review fixes: dev stack bind, login throttle, GDPR erasure, practice isolation#545
dholbach merged 8 commits into
mainfrom
fix/security-audit-run-1

Commits on Oct 28, 2026
- fix(security): bind the dev stack's gunicorn to loopback
  
  dholbach
  and
  claude
  committed
  edfed1b
- fix(security): NFKC-normalize the login throttle key
  
  dholbach
  and
  claude
  committed
  9614486
- fix(gdpr): complete the Art. 17 erasure before notifying the client
  
  dholbach
  and
  claude
  committed
  7ee11fc
- fix(security): make the scoped CRUD views fail closed
  
  dholbach
  and
  claude
  committed
  8940f4c
- fix(security): calendar token lookup with no practice means no practice
  
  dholbach
  and
  claude
  committed
  bae0a28
- fix(security): match calendar events only against the practice's clients
  
  dholbach
  and
  claude
  committed
  aa661f9
- fix(security): key pending calendar events per practice
  
  dholbach
  and
  claude
  committed
  a7f6fc0
- docs: changelog and recent activity for the security review fixes
  
  dholbach
  and
  claude
  committed
  6d06d3c