2 commits

Author	SHA1	Message	Date
TheFlow	9ce02a01ad	chore(docs): archive historical session and analysis documents ... - Archived 44 session handoffs to .claude/session-archive/ - Archived 7 Stripe analyses to docs/stripe-analysis/ - Archived Economist analyses to docs/economist-analysis/ - Archived framework incidents to docs/framework-incidents/ - Archived deployment logs to docs/deployment-logs/ - Created ARCHIVE_SUMMARY_2025-10-21.md with full index - Created OPTIMAL_NEXT_SESSION_STARTUP_PROMPT_2025-10-21.md Result: Root directory reduced from 70+ to 25 essential docs 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>	2025-10-21 11:58:15 +13:00
TheFlow	059dd43b72	security: complete Phase 0 Quick Wins implementation ... Phase 0 Complete (QW-1 through QW-8): ✅ Enhanced input validation with HTML sanitization ✅ Form rate limiting (5 req/min on all submission endpoints) ✅ Modern CSRF protection (SameSite cookies + double-submit pattern) ✅ Security audit logging (CSRF violations captured) ✅ Applied to all public form endpoints: - /api/cases/submit (case studies) - /api/media/inquiries (media inquiries) - /api/newsletter/subscribe (newsletter) New Middleware: - csrf-protection.middleware.js (replaces deprecated csurf package) - Enhanced input-validation.middleware.js applied to all forms Security Features Active: - Security headers (CSP, HSTS, X-Frame-Options, etc.) - Rate limiting (100 req/15min public, 5 req/min forms) - CSRF protection (double-submit cookie pattern) - HTML sanitization (XSS prevention) - Response sanitization (hide stack traces) - Security event logging Implements: inst_041, inst_042, inst_043, inst_044, inst_045, inst_046 Refs: docs/plans/security-implementation-roadmap.md Phase 0	2025-10-14 15:32:54 +13:00