ChuckandClaude Opus 5.5 5e695b7c39 fix(web): keep exception text out of calendar responses; annotate moved code ...

The split made scanners report existing findings in the moved code as new:
- CodeQL: the calendar auth and calendar-list routes returned exception
  text (redacted, but still derived from the exception). Both now log the
  exception and return a fixed message pointing at the log.
- MD5 in the asset upload only makes a filename unique: usedforsecurity=False.
- pickle reads/writes the calendar plugin's own OAuth token (as before):
  annotated. Token-status labels and a log line naming the secrets path are
  false positives: annotated with the repo's nosec/nosemgrep convention.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-28 11:22:24 -04:00

..

api_v3

fix(web): keep exception text out of calendar responses; annotate moved code

2026-09-28 11:22:24 -04:00

__init__.py

Plugins (#145)

2025-12-27 14:15:49 -05:00

pages_v3.py

fix(web): plugin dir resolver in routes, nmcli AP detection, daemon config reload, upload safety, BDF preview (#655)

2026-09-28 10:42:07 -04:00