Fix open redirect vulnerability and implement missing security features

[Copilot]

Security audit identified an open redirect vulnerability in the login flow and several missing safety features for destructive operations.

Security Fixes

• Open redirect in login.vue: The url query parameter was used for post-login redirect without validation. Attackers could craft URLs like /auth/login?url=//evil.com to redirect users to malicious sites.

// Before: Unvalidated redirect
const redirectUrl = route.query.url || '/';

// After: Validated redirect with injection protection
const getValidRedirectUrl = (url: unknown): string => {
    if (typeof url !== 'string' || !url) return '/';
    const sanitized = url.replace(/[\r\n\t]/g, '');
    if (sanitized.startsWith('/') && !sanitized.startsWith('//')) return sanitized;
    return '/';
};

• Account deletion: Added confirmation modal to security.vue with proper session cleanup
• Domain deletion: Implemented empty danger-zone.vue with type-to-confirm pattern

Bug Fixes

• error.vue: Fixed hardcoded 404 to display actual error from props

Cleanup

• Removed unused FormError import in forgot-password.vue
• Removed unused fileRef variable in settings/index.vue

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.fontshare.com
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/APP/APP/node_modules/.bin/nuxt build (dns block)
• api.fontsource.org
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/APP/APP/node_modules/.bin/nuxt build (dns block)
• fonts.bunny.net
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/APP/APP/node_modules/.bin/nuxt build (dns block)
• fonts.google.com
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/APP/APP/node_modules/.bin/nuxt build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

scan the whole repository and app for bad code, bad security, Bugs...
and resolve them. when you are done create a pull request with your changes

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.