[FINAL REVIEW] Complete security review — CSRF, prepared statements, transactions, merge with main#149

Merged

marpisco merged 10 commits into

mainfrom

copilot/review-code-security-backend

May 23, 2026

Commits on May 18, 2026

Initial plan
Copilot
authored
fix(security): add OAuth state validation and CSRF protection across POST forms

Copilot
and
marpisco
authored
fix(security): harden admin API path check and log OAuth state failures

Copilot
and
marpisco
authored
chore(security): enrich OAuth state mismatch audit log context

Copilot
and
marpisco
authored
fix(security): enforce early CSRF rejection and tighten admin API path matching

Copilot
and
marpisco
authored
chore(security): broaden admin API path regex for nested routes

Copilot
and
marpisco
authored
fix(security): normalize admin API path checks and hash OAuth session audit ids

Copilot
and
marpisco
authored
chore(security): handle malformed request URIs in admin API path detection

Copilot
and
marpisco
authored

Commits on May 23, 2026