s.esmaeiliandClaude Opus 5.5 1c850216e9 fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05) ...

- production refuses to boot without JWT_SECRET instead of signing
  admin tokens with the published development key
- CORS_ORIGINS restricts browser callers; blank keeps allow-all with a
  production warning so a running deployment is not cut off
- the boot-time seed creates only roles and permissions in production;
  the demo customers, orders, debt and known-password accounts need
  SEED_DEMO_DATA=true

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-08 11:00:45 +03:30

..

prisma

fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05)

2026-10-08 11:00:45 +03:30

release

feat build

2026-09-25 19:12:39 +03:30

scripts

feat(orders): credit each order to the expert who placed it, as legacy did

2026-10-08 10:40:21 +03:30

src

fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05)

2026-10-08 11:00:45 +03:30

storage

admin panel beter ui

2026-09-19 12:05:59 +03:30

.dockerignore

Fix some for production

2026-09-10 12:17:47 +03:30

.env.example

fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05)

2026-10-08 11:00:45 +03:30

Dockerfile

fix docker

2026-10-04 17:20:04 +03:30

esbuild.release.config.cjs

Fix some for production

2026-09-10 12:17:47 +03:30

jest.config.cjs

parity(api,apps): security hotfix stage 2 - real customer sessions, close IDOR

2026-09-22 01:20:00 +03:30

nest-cli.json

Fix some for production

2026-09-10 12:17:47 +03:30

package.json

feat(import): henza → gold-bank data import tool

2026-10-07 19:35:18 +03:30

tsconfig.build.json

Fix some for production

2026-09-10 12:17:47 +03:30

tsconfig.json

Fix some for production

2026-09-10 12:17:47 +03:30