MechaCat02 4863219cf6 bugfix: equalise login response time across user-existence branches (0.34.1) ...

A login attempt against a non-existent username returned 401 in <1ms,
while the wrong-password branch ran argon2 verify (~50-100ms). Timing
the difference let an attacker enumerate valid usernames without ever
seeing a successful response. Run verify_password against a fixed
dummy argon2id hash on the no-user branch so both paths spend the
same compute.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 07:46:46 +02:00

..

e2e

feat: edit existing manga metadata (0.31.0)

2026-05-27 20:26:23 +02:00

src

feat: edit existing manga metadata (0.31.0)

2026-05-27 20:26:23 +02:00

static

chore: initial project scaffold

2026-05-16 21:05:16 +02:00

.dockerignore

bugfix: third-pass audit follow-ups (F1-F4 + dockerignore)

2026-05-17 00:13:14 +02:00

.gitignore

chore: initial project scaffold

2026-05-16 21:05:16 +02:00

Dockerfile

chore: initial project scaffold

2026-05-16 21:05:16 +02:00

package-lock.json

feat: crawler manga-list & metadata sync with cover download (0.23.0)

2026-05-21 22:04:23 +02:00

package.json

bugfix: equalise login response time across user-existence branches (0.34.1)

2026-05-28 07:46:46 +02:00

playwright.config.ts

chore: release-prep docs, env vars, compose, and e2e port hygiene

2026-05-16 22:58:49 +02:00

svelte.config.js

chore: initial project scaffold

2026-05-16 21:05:16 +02:00

tsconfig.json

chore: initial project scaffold

2026-05-16 21:05:16 +02:00

vite.config.ts

feat: edit existing manga metadata (0.31.0)

2026-05-27 20:26:23 +02:00