- Shipped
- May 29, 2026 at 12:04 AM UTC
- Author
- Kamo
- Commit
- 81f1163
T3 — Security: - New RateLimitFilter (Bucket4j): 1000/min per IP for webhooks, 10/min per session for offer accept/decoder/rescind, 60/min general. Registered ahead of ProxyHmacFilter so abuse hits the bucket before cryptographic verification cost. - SecurityConfig adds HSTS + frameOptions(DENY) + contentTypeOptions via Spring Security HeaderWriter. - StripeConfig fails fast on prod profile with non-live key. T8 — Bug cleanup: - **************** looks up Loan.productIdSnapshot → LoanProduct.feeNsfFlat instead of hard-coded $25. $25 remains the fallback when product or fee is missing. - **************** gains an AdjustmentTarget field (PRINCIPAL / INTEREST / FEES). manualAdjust dispatches per target rather than always touching principal. Audit metadata now records which counter was touched. - **************** finds the most recent ACTIVE *or* PAUSED plan and reactivates it instead of creating a new row that orphans paused ones. - **************** typed FetchResult record with status (OK / NOT_FOUND / UNREACHABLE / UNCONFIGURED). fetchBlob(uid) preserved as legacy bytes-or-null adapter.