`jill-website/CHANGES.md`

10 lines
Implemented the safe fixes and wrote [CHANGES.md](/Users/stevestudio2/Projects/jill-website/CHANGES.md).

Changed:
- Removed hardcoded secret fallbacks from `src/server.ts` and `src/middleware/auth.ts`.
- Updated `.env.example` with placeholders only.
- Added missing `req.body` guards in affected route handlers.
- Escaped user-controlled HTML in unsubscribe output and inquiry email HTML.
- Documented all applied and deferred P0/P1 items in `CHANGES.md`.

Per your instructions, I did not run tests, install packages, or touch git.