Aaron D. Lee 3289f874ab fix: critical review findings — constant-time PIN compare, redact security config, sunset sign ...

- Use hmac.compare_digest() in verify_pin() to prevent timing-based PIN oracle attacks
- Redact entire [security] section (pin_hash, recovery_passphrase_hash) from /api/config response
- Sunset sign fix was skipped: existing longitude - ha formula is correct per NOAA equations and verified by test_sunset_equator; longitude + ha produces sunrise, not sunset

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-03 19:18:14 -04:00

..

__init__.py

Initial commit: Vigilar DIY home security system

2026-04-02 23:11:27 -04:00

pin.py

fix: critical review findings — constant-time PIN compare, redact security config, sunset sign

2026-04-03 19:18:14 -04:00

profiles.py

Fix lint issues in pet detection integration

2026-04-03 13:32:17 -04:00

sender.py

feat(Q5): package event queries and tracker state machine

2026-04-03 18:47:40 -04:00