Block a user
[Bug][Medium]
username unvalidated and not uniqueness-checked on user update
[Bug][Medium] Server boots with no
JWT_SECRET (only a warning)
[Security][High] Uploaded file extension is attacker-controlled → stored XSS
[Security][Medium] Stale JWT: demoted/deleted users keep access until token expiry
[Security][High] No role-based authorization —
editor role is never enforced
Fix #6: larger RTE toolbar buttons + bigger, both-axis-scrolling editor
RTE Posts upgrade: TipTap rich-text editing + sanitization for posts