Alec Perkins
99f810d043
- Signed-out visitors get the same login redirect for missing and private projects, so the redirect no longer reveals private ones. - Production refuses the console email backend; sign-in codes must never reach the logs. - Database cache shared by all workers for allauth rate limits; invite sending throttled per sender and per recipient. - Email invite links are claimed on first use and the token rotated, so a token copied from request logs is worthless. - allauth password URLs removed; adding an email requires a fresh code and notifies existing addresses. - Markdown drops remote images until uploads exist. - Project and org slugs lowercased; only superusers can grant staff status or permissions in the admin. - Container runs as a non-root user; CI actions pinned to commits. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
9 lines
353 B
Python
9 lines
353 B
Python
from .base import * # noqa: F403
|
|
|
|
DEBUG = True
|
|
SECRET_KEY = SECRET_KEY or "dev-insecure-secret-key" # noqa: F405
|
|
ALLOWED_HOSTS = ["localhost", "127.0.0.1", "[::1]"]
|
|
|
|
DATA_DIR.mkdir(exist_ok=True) # noqa: F405
|
|
# Avoid needing `createcachetable` for local development.
|
|
CACHES = {"default": {"BACKEND": "django.core.cache.backends.locmem.LocMemCache"}}
|