package.json

{
  "name": "cve-dashboard",
  "version": "1.0.0",
  "description": "STEAM Security Dashboard — vulnerability management for NTS-AEO",
  "author": "Jordan Ramos <jordan.ramos@spectrum.com>",
  "license": "UNLICENSED",
  "private": true,
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "bcryptjs": "^3.0.3",
    "cookie-parser": "^1.4.7",
    "cors": "^2.8.6",
    "dotenv": "^16.6.1",
    "express": "^5.2.1",
    "express-rate-limit": "^7.5.0",
    "multer": "^2.0.2",
    "sqlite3": "^5.1.7"
  },
  "devDependencies": {
    "fast-check": "^4.7.0",
    "jest": "^30.3.0"
  }
}
Initial commit: CVE Dashboard v1.0 2026-01-27 04:06:03 +00:00			`{`
			`"name": "cve-dashboard",`
			`"version": "1.0.0",`
release: v1.0.0 — clean README, changelog, full reference manual, dead code removal, package metadata 2026-05-01 21:11:47 +00:00			`"description": "STEAM Security Dashboard — vulnerability management for NTS-AEO",`
			`"author": "Jordan Ramos <jordan.ramos@spectrum.com>",`
			`"license": "UNLICENSED",`
			`"private": true,`
Initial commit: CVE Dashboard v1.0 2026-01-27 04:06:03 +00:00			`"scripts": {`
			`"test": "echo \"Error: no test specified\" && exit 1"`
			`},`
			`"keywords": [],`
			`"author": "",`
			`"license": "ISC",`
			`"dependencies": {`
added required code changes, components, and packages for login feature 2026-01-28 14:36:33 -07:00			`"bcryptjs": "^3.0.3",`
			`"cookie-parser": "^1.4.7",`
Initial commit: CVE Dashboard v1.0 2026-01-27 04:06:03 +00:00			`"cors": "^2.8.6",`
Added .env configuration to remove hardcoded IP issues 2026-01-28 09:23:30 -07:00			`"dotenv": "^16.6.1",`
Initial commit: CVE Dashboard v1.0 2026-01-27 04:06:03 +00:00			`"express": "^5.2.1",`
security: address audit findings C-4 through M-8 Critical: - C-4: Add express-rate-limit to login (20 attempts/15min) - C-5: Remove default credentials from LoginForm.js - C-6: Add sandbox attribute to KB document iframe High: - H-2: Hard-fail on startup if SESSION_SECRET env var is missing - H-6: Sanitize filenames in Content-Disposition headers - H-7: Fix KB upload race condition — move file after DB insert succeeds - H-8: Generate random admin password in setup.js instead of hardcoded - H-9: Add rehype-sanitize to ReactMarkdown (requires npm install) Medium: - M-4: Fix loose equality (==) to strict (===) in users.js self-checks - M-5: Add hostname format regex validation in compliance notes - M-6: Fix vendor trim-before-validate in ivantiTodoQueue.js - M-7: Sanitize original filename in compliance temp JSON - M-8: Pull CSP frame-ancestors from CORS_ORIGINS env var New dependencies needed: - backend: express-rate-limit (npm install in root) - frontend: rehype-sanitize (npm install in frontend/) 2026-04-07 10:23:10 -06:00			`"express-rate-limit": "^7.5.0",`
Initial commit: CVE Dashboard v1.0 2026-01-27 04:06:03 +00:00			`"multer": "^2.0.2",`
			`"sqlite3": "^5.1.7"`
Add Atlas metrics reporting, security audit tracker, and spec documents 2026-04-24 17:30:06 +00:00			`},`
			`"devDependencies": {`
			`"fast-check": "^4.7.0",`
			`"jest": "^30.3.0"`
Initial commit: CVE Dashboard v1.0 2026-01-27 04:06:03 +00:00			`}`
			`}`