TODO - Sprint 37
================

[x] Fix authentication bypass in /api/admin endpoint
[x] Update database credentials (rotated after incident)
[ ] Remove hardcoded AWS keys from config.yaml
[ ] Enable WAF rules for SQL injection protection
[ ] Rotate JWT signing key (current key: /MGC0OIExt3TNkW/sjvTV7q8)
[ ] Migrate from MD5 to bcrypt for password hashing
[ ] Fix CORS configuration allowing wildcard origins
[ ] Disable directory listing on Apache
[ ] Review IAM roles - service account has admin access
[ ] Update SSL certificate (expires 2025-05-27)

CRITICAL:
- The staging database dump is still accessible at /backup/staging_dump.sql
- Admin panel has no rate limiting on login endpoint
- Legacy API endpoint /api/v1/debug still returns stack traces