SSRF Protection — All external URL fetches (image provider, bulk helpers) now use ssrfSafeFetch with strict timeouts and domain validation
Token Encryption — Meta API tokens encrypted at rest with AES-256. Refresh workers use encrypted storage exclusively
RBAC Enforcement — Billing endpoints (cancel, change-plan, extra-users) now require proper role authorization. Finance role removed from cross-tenant admin bypass
Tenant Isolation — Worker run status endpoints now enforce session-based data isolation. Added ownership checks on thumbnail/video URL signing
HMAC Verification — Public postback endpoints validate HMAC signatures. OAuth state comparison uses timing-safe equality
CORS Hardening — Wildcard origin rejected in non-local environments. Strict origin validation in production
Meta API Auth Migration — All Meta API calls migrated from URL query params to Bearer header authorization. Plaintext token fallback rejected in production
Input Validation — TypeBox schema validation hardened across all endpoints. Mass assignment prevention on user-modifiable objects
✨ Improved
TLS Verification — PostgreSQL connections now require TLS certificate verification in production
Credit System — Row-level locking (FOR UPDATE) on AI chat credit deduction prevents race conditions