Skip to content
This repository was archived by the owner on Jun 4, 2026. It is now read-only.

Fixed security #3345

Open
Originalckjha wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fixed security #3345

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7c19edb
Improve security, performance, and code quality across the stack
claude Apr 16, 2026
2a5196c
Merge pull request #1 from Originalckjha/claude/improve-codebase-40od6
Originalckjha Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions assets/js/subscribe.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ const successNotif = document.getElementById('successnotification');
})

function showSuccess() {
console.log('yee')
successNotif.style.display = 'flex';
setTimeout(() => {
successNotif.style.display = 'none';
Expand All @@ -19,8 +18,7 @@ document.addEventListener('DOMContentLoaded', () => {
const subscribeSubmit = document.getElementById('subscribe-btn');
subscribeSubmit.addEventListener('click', (event) => {
const emailInput = document.getElementById('news-email');
console.log("ksdjfh");


if (emailInput.value === '') {
// Empty input
return;
Expand Down
40 changes: 18 additions & 22 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,8 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Home - FinVeda</title>
<meta name="description" content="" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<meta name="description"
content="FinVeda provides comprehensive resources and tools for financial education, investment strategies, and personal finance management. Discover your path to financial wellness today!">
content="FinVeda provides comprehensive resources and tools for financial education, investment strategies, and personal finance management. Discover your path to financial wellness today!" />
<meta name="keywords"
content="finance, financial education, personal finance, investment strategies, financial wellness, budgeting, money management">
<meta name="author" content="Ayush That">
Expand All @@ -23,10 +21,8 @@
<meta name="twitter:title" content="FinVeda - Your Guide to Financial Wellness">
<meta name="twitter:description"
content="Explore a wealth of financial resources at FinVeda to enhance your financial literacy and investment skills.">
<link rel="stylesheet" href="https://unpkg.com/aos@next/dist/aos.css" />
<link rel="manifest" href="/manifest.json">
<link href="https://unpkg.com/aos@2.3.1/dist/aos.css" rel="stylesheet">
<link rel="stylesheet" href="https://unpkg.com/aos@next/dist/aos.css" />
<!-- Structured Data -->
<script type="application/ld+json">
{
Expand All @@ -40,7 +36,7 @@
"name": "FinVeda",
"logo": {
"@type": "ImageObject",
"url": "/assets/images/favicon2.webp" // Replace with your logo URL
"url": "/assets/images/favicon2.webp"
}
}
}
Expand All @@ -58,7 +54,7 @@
<link rel="stylesheet" href="./assets/css/quiz.css" />
<link rel="stylesheet" href="./assets/css/popup.css" />
<link rel="stylesheet" href="./assets/css/cookiepopup.css">
<link rel="stylesheet" href="./assets\css\preloader.css" />
<link rel="stylesheet" href="./assets/css/preloader.css" />
<link rel="stylesheet" href="./assets/css/faq.css">
<link rel="stylesheet" href="./assets/css/index.css">
<link rel="stylesheet" type="text/css" href="sipcalculatorCss.css">
Expand Down Expand Up @@ -1032,7 +1028,7 @@ <h2 class="head-animate" style="font-size: 90px;">
style="visibility: visible; animation-duration: 1.3s; animation-delay: 1.4s;">
<div class="anim" data-tilt="">
<img src="assets/images/header-hero.webp" style="animation: float 1.5s ease-in-out infinite;"
data-tilt="" />
data-tilt="" alt="FinVeda financial platform illustration" />
</div>
</div>
</div>
Expand Down Expand Up @@ -1271,7 +1267,7 @@ <h3 class="title" style="color: #2f6be5;">
<!-- TradingView Widget BEGIN -->
<div class="tradingview-widget-container" style="height: 372px;">
<div id="tv-widget-container" data-aos="slide-left">
<img src="assets/images/finance.jpg">
<img src="assets/images/finance.jpg" alt="Finance overview" loading="lazy">
</div>


Expand Down Expand Up @@ -1439,7 +1435,7 @@ <h3 class="title" style="color: #2f6be5;">
</div>
<div class="col-lg-6 order-lg-first" data-aos="slide-right">
<div id="about-4-img">
<img src="assets/images/portfolio-optimize.png">
<img src="assets/images/portfolio-optimize.png" alt="Portfolio optimization chart" loading="lazy">
</div>
</div>

Expand Down Expand Up @@ -1507,10 +1503,10 @@ <h3 class="title" style="color:#2f6be5;">
<div class="row">
<div class="col-lg-6" data-aos="slide-right">
<div class="video-content mt-50 wow fadeIn" data-wow-duration="1s" data-wow-delay="0.5s">
<img class="dots" src="assets/images/dots.svg" alt="dots" />
<img class="dots" src="assets/images/dots.svg" alt="" role="presentation" loading="lazy" />
<div class="video-wrapper">
<div class="video-image">
<img src="assets/images/video.webp" alt="video" />
<img src="assets/images/video.webp" alt="Investment video thumbnail" loading="lazy" />
</div>
<div class="video-icon">
<a href="https://www.youtube.com/watch?v=fUtDU0U7Zqw" class="video-popup"
Expand Down Expand Up @@ -1587,7 +1583,7 @@ <h3 class="title" style="color: #2f6be5;"><span>Meet Our</span> tech-savvy Team<
<div class="col-lg-4 col-md-7 col-sm-8">
<div class="single-team text-center mt-30 wow fadeIn" data-wow-duration="1s" data-wow-delay="0.2s">
<div class="team-image">
<img class="images-team" src="assets/images/img-1.webp" alt="Team" />
<img class="images-team" src="assets/images/img-1.webp" alt="Manya Singh" loading="lazy" />
<div class="social-pill">
<div class="left">
<a href="https://twitter.com/manyasingh297" title="X profile of Manya Singh"><i
Expand All @@ -1611,7 +1607,7 @@ <h3 class="holder-name"><a href="#">Manya Singh</a></h3>
<div class="col-lg-4 col-md-7 col-sm-8">
<div class="single-team text-center mt-30 wow fadeIn" data-wow-duration="1s" data-wow-delay="0.5s">
<div class="team-image">
<img class="images-team" src="assets/images/img-2.webp" alt="Team" />
<img class="images-team" src="assets/images/img-2.webp" alt="Ayush Singh" loading="lazy" />
<div class="social-pill">
<div class="left">
<a href="https://twitter.com/ayushdotpro" title="X profile of Ayush Singh"><i
Expand Down Expand Up @@ -1651,7 +1647,7 @@ <h3 class="holder-name"><a href="#">Ayush Singh</a></h3>
<main class="forum-body">
<main class="forum-main">
<img src="assets/images/discuss.png" style="position: absolute;mix-blend-mode: multiply;left: 100px;"
alt="dicuss">
alt="Discussion forum illustration" loading="lazy">
<section style="width: 1000px; height: 800px;" id="destinations" class="destinations">
<h1 class="forum-title" style="color: white;"> Discussion Forum</h1>
<div style="width: 800px; height: 600px;" class="post-container">
Expand Down Expand Up @@ -1766,7 +1762,7 @@ <h3 style="margin-top: 50px; margin-bottom: 10px;font-size:2.9rem;" class="title
</div>
<div style="margin-top: 0px;" class="slider">
<div class="item">
<img src="https://i.pravatar.cc/250?u=user1@finveda.com" alt="Aditi Verma">
<img src="https://i.pravatar.cc/250?u=user1@finveda.com" alt="Aditi Verma" loading="lazy">
<div class="stars">★★★★★</div>
<p>"FinVeda is a revolutionary app that makes financial literacy accessible to everyone. The AI-powered consultant
gave me personalized advice, and the finance tools helped me manage my budget more effectively. "</p>
Expand All @@ -1776,7 +1772,7 @@ <h2>- Aditi Verma</h2>
</div>

<div class="item">
<img src="https://i.pravatar.cc/250?u=user2@finveda.com" alt="Rohit Sharma">
<img src="https://i.pravatar.cc/250?u=user2@finveda.com" alt="Rohit Sharma" loading="lazy">
<div class="stars">★★★★★</div>
<p>"The quizzes and blogs on FinVeda are engaging and easy to understand. They’ve improved my financial literacy
and taught me things I wish I'd known earlier. The market trends feature keeps me informed every day."</p>
Expand All @@ -1786,7 +1782,7 @@ <h2>- Rohit Sharma</h2>
</div>

<div class="item">
<img src="https://i.pravatar.cc/250?u=user3@finveda.com" alt="Priya Desai">
<img src="https://i.pravatar.cc/250?u=user3@finveda.com" alt="Priya Desai" loading="lazy">
<div class="stars">★★★★</div>
<p>"FinVeda has made learning finance approachable and fun. The AI-powered consultant provided real insights, and
the finance tools have been invaluable in my journey towards financial independence. Highly recommended!"</p>
Expand All @@ -1796,7 +1792,7 @@ <h2>- Priya Desai</h2>
</div>

<div class="item">
<img src="https://i.pravatar.cc/250?u=user4@finveda.com" alt="Suresh Iyer">
<img src="https://i.pravatar.cc/250?u=user4@finveda.com" alt="Suresh Iyer" loading="lazy">
<div class="stars">★★★★★</div>
<p>"FinVeda’s platform has given me the confidence to manage my finances. The tools, blogs, and quizzes make
complex concepts easy to grasp. It’s been a game-changer for my financial knowledge."</p>
Expand All @@ -1806,7 +1802,7 @@ <h2>- Suresh Iyer</h2>
</div>

<div class="item">
<img src="https://i.pravatar.cc/250?u=user5@finveda.com" alt="Anjali Mehta">
<img src="https://i.pravatar.cc/250?u=user5@finveda.com" alt="Anjali Mehta" loading="lazy">
<div class="stars">★★★★★</div>
<p>"The financial tools on FinVeda have helped me build a budget and stick to it. The AI consultant is a unique
addition, providing insights that I never expected from an app. FinVeda truly empowers users!"</p>
Expand All @@ -1816,7 +1812,7 @@ <h2>- Anjali Mehta</h2>
</div>

<div class="item">
<img src="https://i.pravatar.cc/250?u=user6@finveda.com" alt="Rajesh Gupta">
<img src="https://i.pravatar.cc/250?u=user6@finveda.com" alt="Rajesh Gupta" loading="lazy">
<div class="stars">★★★★</div>
<p>"With FinVeda, I've gained a new level of control over my finances. The app is packed with useful features, and
the financial blogs keep me updated on the latest trends in the market."</p>
Expand All @@ -1826,7 +1822,7 @@ <h2>- Rajesh Gupta</h2>
</div>

<div class="item">
<img src="https://i.pravatar.cc/250?u=user7@finveda.com" alt="Neha Singh">
<img src="https://i.pravatar.cc/250?u=user7@finveda.com" alt="Neha Singh" loading="lazy">
<div class="stars">★★★★★</div>
<p>"FinVeda’s blend of financial tools, quizzes, and AI-driven advice has made understanding finance easy and
enjoyable. It’s the perfect app for anyone aiming to improve their financial literacy."</p>
Expand Down
5 changes: 4 additions & 1 deletion news/backend/app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import os
from flask import Flask, jsonify
from news_api import get_curated_news_feed

Expand All @@ -10,4 +11,6 @@ def get_news_feed():
return jsonify(news_feed)

if __name__ == '__main__':
app.run(debug=True)
debug = os.environ.get('FLASK_DEBUG', 'false').lower() == 'true'
port = int(os.environ.get('PORT', 5001))
app.run(debug=debug, port=port)
56 changes: 48 additions & 8 deletions server/app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,30 +6,70 @@ import contactRoutes from "./routes/contactRoutes.js";
import newsletterRoutes from "./routes/newsletterRoutes.js";
import feedbackRoutes from "./routes/feedbackRoutes.js";
import addBlog from "./routes/addBlogRoutes.js";
import path from "path"; // Import path module
import { fileURLToPath } from "url"; // Import fileURLToPath

import path from "path";
import { fileURLToPath } from "url";
import { rateLimiter } from "./middleware/rateLimiter.js";

dotenv.config();
const app = express();
connectDB();

app.use(express.json());
// Body size limit to prevent large payload attacks
app.use(express.json({ limit: "10kb" }));
app.use(express.urlencoded({ extended: true, limit: "10kb" }));

// CORS — restrict to known origins in production
const allowedOrigins = process.env.ALLOWED_ORIGINS
? process.env.ALLOWED_ORIGINS.split(",")
: ["http://localhost:5500", "http://127.0.0.1:5500"];

app.use(
cors({
origin: (origin, callback) => {
// Allow requests with no origin (curl, Postman, same-origin)
if (!origin || allowedOrigins.includes(origin)) {
callback(null, true);
} else {
callback(new Error("Not allowed by CORS"));
}
},
methods: ["GET", "POST"],
allowedHeaders: ["Content-Type"],
})
);

// Basic security headers
app.use((_req, res, next) => {
res.setHeader("X-Content-Type-Options", "nosniff");
res.setHeader("X-Frame-Options", "DENY");
res.setHeader("X-XSS-Protection", "1; mode=block");
next();
});

// to avoid cross-origin error
app.use(cors());
const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

// Serve uploaded files (static)
app.use("/uploads", express.static(path.join(__dirname, "uploads")));

// Serve static files from the uploads directory
app.use("/api/contact", contactRoutes);
// Apply rate limiting to all API routes
app.use("/api", rateLimiter);

app.use("/api/contact", contactRoutes);
app.use("/api/feedback", feedbackRoutes);
app.use("/api/addBlog", addBlog);
app.use("/api/newsletter", newsletterRoutes);

// 404 handler
app.use((_req, res) => {
res.status(404).json({ message: "Route not found." });
});

// Global error handler
app.use((err, _req, res, _next) => {
console.error("Unhandled error:", err);
res.status(500).json({ message: "An unexpected error occurred." });
});

const PORT = process.env.PORT || 5000;
app.listen(PORT, () => {
Expand Down
Loading