Abhimanyu Saharan fb8a932923 fix(security): Close review follow-up gaps ...

Rate-limit the optional agent bearer path after user auth resolution so mixed user/agent routes no longer leave an unthrottled PBKDF2 path. Stop logging token prefixes on agent auth failures and require a locally supplied token for backend/.env.test instead of committing one.

Update tests and docs to cover agent bearer fallback, configurable webhook signature headers, and the operator-facing security settings added by the hardening work.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-03-07 23:40:50 +05:30

1.1 KiB

Raw Blame History

View Raw