Vectry e9cd11735c security: fix trace ownership bypass and externalize secrets to .env ...

- Add userId guard in trace upsert to prevent cross-user overwrites
- Move AUTH_SECRET, STRIPE_WEBHOOK_SECRET, POSTGRES_PASSWORD to .env
- docker-compose.yml now references env vars instead of hardcoded secrets
- Add .env.example with placeholder values for documentation

2026-02-10 16:53:57 +00:00

..

web

security: fix trace ownership bypass and externalize secrets to .env

2026-02-10 16:53:57 +00:00