security: remove hardcoded secrets, add secure defaults and CI/CD workflows

- Replace hardcoded JWT secret/encryption key with env-var loading + auto-generated random fallback
- Remove hardcoded admin/admin1234 credentials, add CLI-based admin creation with password policy
- Fix deterministic salt in encryption to use os.urandom()
- Fix CORS wildcard to configurable origins
- Add nightly.yml and weekly.yml CI/CD workflows with security scanning
- Update README with security configuration section

Author: srpatcha

.github/workflows/nightly.yml

@@ -0,0 +1,62 @@
+name: Nightly Build & Test
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+jobs:
+  nightly:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Lint
+        run: ruff check src/ tests/
+
+      - name: Type check
+        run: mypy src/edb/ --ignore-missing-imports
+
+      - name: Test with coverage
+        run: pytest --cov=edb --cov-report=xml --cov-report=term-missing -v
+
+      - name: Security scan - secrets
+        run: |
+          pip install detect-secrets
+          detect-secrets scan --all-files --baseline .secrets.baseline || true
+
+      - name: Security scan - dependencies
+        run: |
+          pip install pip-audit
+          pip-audit --strict || true
+
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npx tsc --noEmit
+
+      - name: Build
+        run: npm run build

.github/workflows/weekly.yml

@@ -0,0 +1,63 @@
+name: Weekly Comprehensive Tests
+
+on:
+  schedule:
+    - cron: '0 6 * * 0'
+  workflow_dispatch:
+
+jobs:
+  full-test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Full test suite with coverage
+        run: pytest --cov=edb --cov-report=xml --cov-report=term-missing -v --tb=long
+
+      - name: Security audit - dependencies
+        run: |
+          pip install pip-audit safety
+          pip-audit --strict
+          safety check || true
+
+      - name: Check for hardcoded secrets
+        run: |
+          pip install detect-secrets
+          detect-secrets scan --all-files --force-use-all-plugins 2>&1 | \
+            grep -v "ArtifactoryDetector\|AWSKeyDetector" || true
+
+      - name: SAST scan
+        run: |
+          pip install bandit
+          bandit -r src/edb/ -ll -ii || true
+
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npx tsc --noEmit
+
+      - name: Build
+        run: npm run build

README.md

@@ -34,9 +34,12 @@ git clone https://github.com/embeddedos-org/eDB.git
 cd eDB
 pip install -e ".[dev]"
 
-# Initialize database with default admin
+# Initialize database
 edb init
 
+# Create admin user (interactive password prompt)
+edb admin create --username admin
+
 # Start the server
 edb serve --port 8000
 
@@ -135,8 +138,39 @@ EDB_API_HOST=0.0.0.0
 EDB_API_PORT=8000
 EDB_JWT_SECRET=your-strong-secret-here
 EDB_ENCRYPTION_KEY=your-encryption-key
+EDB_CORS_ORIGINS=http://localhost:3000,https://yourdomain.com
+```
+
+## Security
+
+### Required Environment Variables for Production
+
+| Variable | Description |
+|----------|-------------|
+| `EDB_JWT_SECRET` | **Required.** Secret key for JWT signing. If not set, a random key is generated per session (tokens won't persist across restarts). |
+| `EDB_ENCRYPTION_KEY` | **Required.** Key for AES-256-GCM encryption at rest. If not set, a random key is generated (encrypted data won't be recoverable after restart). |
+| `EDB_CORS_ORIGINS` | Comma-separated allowed origins. Defaults to `http://localhost:3000`. |
+
+### Admin User Setup
+
+Admin users are **not** auto-created. Use the CLI to create one:
+
+```bash
+edb admin create --username admin
+# You'll be prompted for a password interactively.
+# Password must be 12+ chars with uppercase, lowercase, digit, and special char.
 ```
 
+### Security Best Practices
+
+- Always set `EDB_JWT_SECRET` and `EDB_ENCRYPTION_KEY` in production
+- Use strong, unique values (e.g., `openssl rand -base64 48`)
+- Never commit `.env` files to version control
+- Restrict CORS origins to your actual frontend domains
+- Review audit logs regularly via `/admin/audit` endpoint
+
+See [SECURITY.md](SECURITY.md) for vulnerability reporting.
+
 ## Development
 
 ### Python Backend
@@ -180,10 +214,6 @@ ruff format src/ tests/
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
-## Security
-
-See [SECURITY.md](SECURITY.md) for vulnerability reporting and security best practices.
-
 ## License
 
 MIT License. See [LICENSE](LICENSE) for details.

src/edb/api/app.py

@@ -14,6 +14,8 @@
 from edb.api.routes import admin, auth, documents, ebot, graph, kv, sql
 from edb.config import EDBConfig
 
+logger = logging.getLogger("edb.api")
+
 
 @asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
@@ -23,8 +25,6 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
 
     logging.basicConfig(level=getattr(logging, config.log_level.upper(), logging.INFO))
 
-    if config.create_admin:
-        state.user_manager.ensure_admin_exists()
     yield
     state.database.close()
 
@@ -40,12 +40,13 @@ def create_app(config: EDBConfig | None = None) -> FastAPI:
         lifespan=lifespan,
     )
 
+    origins = [o.strip() for o in config.cors_origins.split(",") if o.strip()]
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=["*"],
+        allow_origins=origins,
         allow_credentials=True,
-        allow_methods=["*"],
-        allow_headers=["*"],
+        allow_methods=["GET", "POST", "PUT", "DELETE", "PATCH"],
+        allow_headers=["Authorization", "Content-Type"],
     )
 
     if config.rate_limit_enabled:

src/edb/auth/jwt_handler.py

@@ -16,7 +16,7 @@ class JWTHandler:
 
     def __init__(
         self,
-        secret_key: str = "edb-secret-change-me-in-production",
+        secret_key: str,
         algorithm: str = "HS256",
         access_token_expire_minutes: int = 60,
         refresh_token_expire_days: int = 7,

src/edb/auth/users.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import logging
+import re
 import uuid
 from datetime import UTC, datetime
 from typing import Any
@@ -15,10 +16,28 @@
 USERS_TABLE = "_edb_users"
 logger = logging.getLogger("edb.auth.users")
 
-
-
-
-USERS_TABLE = "_edb_users"
+MIN_PASSWORD_LENGTH = 12
+PASSWORD_POLICY = (
+    "Password must be at least 12 characters and contain uppercase, "
+    "lowercase, digit, and special character."
+)
+
+
+def validate_password_strength(password: str) -> None:
+    """Enforce password complexity requirements."""
+    errors: list[str] = []
+    if len(password) < MIN_PASSWORD_LENGTH:
+        errors.append(f"at least {MIN_PASSWORD_LENGTH} characters")
+    if not re.search(r"[A-Z]", password):
+        errors.append("an uppercase letter")
+    if not re.search(r"[a-z]", password):
+        errors.append("a lowercase letter")
+    if not re.search(r"\d", password):
+        errors.append("a digit")
+    if not re.search(r"[!@#$%^&*(),.?\":{}|<>\-_=+\[\]\\;'/`~]", password):
+        errors.append("a special character")
+    if errors:
+        raise ValueError(f"Password too weak — must contain: {', '.join(errors)}")
 
 
 class UserManager:
@@ -42,11 +61,14 @@ def _ensure_table(self) -> None:
         """)
         self._engine.commit()
 
-    def create_user(self, user_data: UserCreate) -> UserResponse:
+    def create_user(self, user_data: UserCreate, skip_password_check: bool = False) -> UserResponse:
         """Create a new user with hashed password."""
         if self.get_by_username(user_data.username):
             raise ValueError(f"Username '{user_data.username}' already exists")
 
+        if not skip_password_check:
+            validate_password_strength(user_data.password)
+
         user_id = str(uuid.uuid4())
         now = datetime.now(UTC).isoformat()
         password_hash = self._hash_password(user_data.password)
@@ -124,17 +146,20 @@ def deactivate_user(self, user_id: str) -> bool:
         self._engine.commit()
         return cursor.rowcount > 0
 
-    def ensure_admin_exists(self) -> None:
-        """Create a default admin user if no admins exist."""
+    def ensure_admin_exists(self, username: str, password: str) -> None:
+        """Create an admin user with the provided credentials if no admins exist."""
+        validate_password_strength(password)
         row = self._engine.fetchone(
             f'SELECT id FROM "{USERS_TABLE}" WHERE role = ?', (Role.ADMIN.value,)
         )
         if row is None:
-            self.create_user(UserCreate(
-                username="admin",
-                password="admin1234",
-                role=Role.ADMIN,
-            ))
+            self.create_user(
+                UserCreate(username=username, password=password, role=Role.ADMIN),
+                skip_password_check=True,
+            )
+            logger.info("Admin user '%s' created.", username)
+        else:
+            logger.info("Admin user already exists, skipping creation.")
 
     def change_password(self, user_id: str, current_password: str, new_password: str) -> bool:
         """Change a user password after verifying the current one."""
@@ -143,6 +168,7 @@ def change_password(self, user_id: str, current_password: str, new_password: str
             return False
         if not self._verify_password(current_password, user.password_hash):
             return False
+        validate_password_strength(new_password)
         new_hash = self._hash_password(new_password)
         now = datetime.now(UTC).isoformat()
         cursor = self._engine.execute(