BREAKING CHANGE: Admin password is now auto-generated on first setup
Security improvements:
- Remove hardcoded 'admin123' password completely
- Generate secure random password on first installation
- Save credentials to ADMIN_CREDENTIALS.txt (git-ignored)
- Force password change on first login
- Implement strong password requirements (12+ chars, mixed case, numbers, special)
- Add password strength validation
- Increase bcrypt rounds from 10 to 12
New features:
- Password generator utility with secure random generation
- Human-readable password format (e.g., SwiftEagle3847\!)
- Password reset script for existing installations
- Comprehensive admin setup documentation
- Must-change-password flag in database
Migration guide:
- New installations: Check ADMIN_CREDENTIALS.txt for generated password
- Existing installations: Run scripts/reset-admin-password.js
- All users must change password on first login after update
This fixes a critical vulnerability where all installations used the same
default admin password, allowing unauthorized access.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Replace short dev secrets with secure 64-character (256-bit) secrets
- Update docker-compose.yml with secure development secret
- Update docker-compose.local.yml with unique secure secret
- Improve .env.example with clear security instructions
- Add comprehensive security best practices documentation
- Create helper script to generate secure JWT secrets
Security improvements:
- All environments now use cryptographically secure 64-character secrets
- Clear warnings and instructions prevent use of weak secrets
- Documentation guides proper secret management
- Helper script makes it easy to generate new secrets
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
BREAKING CHANGE: Server now requires JWT_SECRET environment variable to be set
Security fixes:
- Remove hardcoded JWT secret fallback 'your-secret-key' from protectedImages.js
- Add startup validation to ensure JWT_SECRET is properly configured
- Reject insecure default values and short secrets
- Server will refuse to start without proper JWT_SECRET
This fixes a critical vulnerability where the application would use a publicly
known secret if JWT_SECRET was not set, completely compromising authentication.
Migration guide: docs/JWT_SECRET_MIGRATION.md
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add simple test workflow to verify Gitea Actions functionality
- Create comprehensive setup guide for troubleshooting Actions
- Include runner installation and registration steps
- Document common issues and solutions
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
paul