Claude 6e082ce58f Stream D: Security hardening — 10 fixes from QA review ... - SEC-05: Fail fast if SECRET_KEY is default 'change-me-in-production' - SEC-06: CORS allow_credentials=False (Bearer tokens don't need it) - SEC-08: Input validation on auth schemas (min/max length, username pattern) - SEC-10: .dockerignore files (root, backend, mcp-connector) - SEC-11: Hardcode ALGORITHM='HS256' as constant, remove from settings - CQ-01: Gate crawl scheduler on CRAWL_ENABLED env var (default false) - OS-02: CONTRIBUTING.md - OS-03: CHANGELOG.md with v1.0.0 entry - setup.ps1: Add API_TOKEN generation (Windows parity with setup.sh)		2026-06-21 23:13:53 +00:00
..
__init__.py	Initial commit: full fitness-rewards app	2026-03-14 23:53:00 +00:00
activity.py	Fix: add future annotations to all files, fix date field name shadowing type in RewardRedeemRequest	2026-03-15 00:42:13 +00:00
auth.py	Stream D: Security hardening — 10 fixes from QA review	2026-06-21 23:13:53 +00:00
food.py	Fix: add future annotations to all files, fix date field name shadowing type in RewardRedeemRequest	2026-03-15 00:42:13 +00:00
nutrition.py	Feature: nutrition module (keto macros + intermittent fasting + electrolytes)	2026-04-12 05:13:52 +00:00
onboarding.py	Feature: expanded equipment, integration-aware sync, tooltips	2026-03-15 22:16:55 +00:00
points.py	Fix: add future annotations to all files, fix date field name shadowing type in RewardRedeemRequest	2026-03-15 00:42:13 +00:00
reward.py	Fix: add future annotations to all files, fix date field name shadowing type in RewardRedeemRequest	2026-03-15 00:42:13 +00:00