PR

• Have you followed the contributing guidelines?
• Have you explained what your changes do, and why they add value?

Please note: we will close your PR without comment if you do not check the boxes above and provide ALL requested information.

---

---

Summary by cubic

Hardened security across the API and deployments: enforce CORS via ALLOWED_ORIGINS with startup warnings, block weak JWT secrets at boot, strengthen password/code policies, tighten auth/user endpoints and uploads, and harden Kubernetes pods/containers. Also improved email verification expiry and moved runtime logs to Nest Logger.

• New Features

  • CORS: ALLOWED_ORIGINS parsed in bootstrap; wired through env files, Docker/K8s/Render manifests, and GitHub Actions; warns if not set.
  • Kubernetes: seccompProfile RuntimeDefault; containers run as non-root, no privilege escalation, read-only root FS, drop all capabilities.
  • Startup checks: reject insecure default JWT/refresh/verification secrets in production.
  • Passwords/codes: strong password validation; 8-char codes with crypto-secure generation; updated demo magic code.
  • Email verification: always set codeExpireAt (7 days); safer token handling; better logging.
  • Safer endpoints/logging: stricter folder sanitization for image uploads; guards + permissions on user email/id; relation allowlist; replace console logs with Nest Logger across auth/JWT/email, storage providers, uploads, interceptors, and controllers.
  • Multi-ORM: add MikroORM repos and usage in user, social account, employee, and password reset services.

• Migration

  • Set ALLOWED_ORIGINS to trusted domains in env files, CI secrets, and deployment manifests.
  • Use non-default values for JWT_SECRET, JWT_REFRESH_TOKEN_SECRET, and verification secrets; the server will refuse to start otherwise.
  • Frontend should display new password strength errors in change/reset flows.