Claude 6e082ce58f Stream D: Security hardening — 10 fixes from QA review

- SEC-05: Fail fast if SECRET_KEY is default 'change-me-in-production'
- SEC-06: CORS allow_credentials=False (Bearer tokens don't need it)
- SEC-08: Input validation on auth schemas (min/max length, username pattern)
- SEC-10: .dockerignore files (root, backend, mcp-connector)
- SEC-11: Hardcode ALGORITHM='HS256' as constant, remove from settings
- CQ-01: Gate crawl scheduler on CRAWL_ENABLED env var (default false)
- OS-02: CONTRIBUTING.md
- OS-03: CHANGELOG.md with v1.0.0 entry
- setup.ps1: Add API_TOKEN generation (Windows parity with setup.sh)

2026-06-21 23:13:53 +00:00

873 B

Raw Blame History

Contributing to Diligence

Thanks for your interest in contributing!

How to contribute

Open an issue to discuss the change before starting work
Fork the repo and create a branch from main
Test locally: docker compose up -d and verify all 4 containers start healthy
Submit a PR with a clear description of what changed and why

Development setup

git clone https://github.com/DiligenceWorks/Diligence.git
cd Diligence
./setup.sh          # Mac/Linux
docker compose up -d

Open http://localhost and register. First user gets admin automatically.

Code style

Backend: Python 3.11+, FastAPI, async/await, type hints
Frontend: React with hooks, no class components
CSS: use CSS variables from index.css, never hardcode colors

Questions?

Open a GitHub Discussion or reach out at hello@diligenceworks.online.