Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

#925 Automated mainnet deployment checklist CI (mainnet-checklist.yml) enforcing WASM build, full test suite, no TODO/FIXME in security-critical files, CHANGELOG update, and Clippy strict; deploy-mainnet.yml workflow blocks on checklist passing. Manual checklist items documented in PRODUCTION_READINESS_CHECKLIST.md.
#933 Cargo-fuzz targets for validate_amount, corridor validation, and validate_evidence_hash (recipient hash), with seed corpus and a 30-second CI job (fuzz-ci.yml).
#938 Content Security Policy enforced on the frontend: strict CSP in Vite dev server, <meta> tag injection for production builds, HTTP response headers in vercel.json and _headers. Staging uses Content-Security-Policy-Report-Only first before production enforcement.
#940 Input sanitization applied to all user-supplied string fields across backend API endpoints (api.ts, routes/compliance.ts) and API service routes (agents, auth, anchors). Parameterized query audit confirmed across all DB-touching code paths.

All free-form string fields in backend/src/api.ts and backend/src/routes/compliance.ts now pass through sanitizeInput (XSS library) before storage.
API service (api/src/routes/) sanitizes name, payout_address, userId, and anchor provider string fields via a new sanitizeInput/sanitizeObject utility.
validateAssetParams middleware now mutates req.body with sanitized assetCode and issuer before passing to route handlers.

withdraw_integrator_fees correctly returns NoFeesToWithdraw when balance is zero