vking

Day 9 update. long session; full security and efficiency audit across the entire codebase. auth, authorization, rate limiting, input validation, data exposure, file uploads, background jobs, frontend rendering, database queries, environment config. auth hardened. session secret fallback removed, sensitive fields stripped consistently across all user-facing endpoints, admin routes now have defense-in-depth middleware at both the router and route level. input validation added to every write endpoint. entries, comments, revisions, votes, CA embeds. every POST was passing raw request body straight to the database with no schema validation. authorization gaps fixed. mods could approve articles they authored. the check existed on edit approval but was missing on article approval entirely. same-IP approvals now notify all master accounts in real time instead of writing a silent audit log. data integrity fixes. weekly leaderboard reset is now atomic, snapshot write and points reset happen in a single transaction. daily points boost cron checks a last-run timestamp before executing so it can't double-award on restart or overlap. all four background jobs have an overlap guard so a slow run can't spawn a second instance. still building, more soon.