02d37a110b9b60bf37b6e77d3507946064e5ed48
loadAndParse + LoadFromBytes ran os.ExpandEnv over the whole YAML before parse; a bcrypt hash ($2a$10$...) is full of $word sequences that get replaced with empty env values, silently corrupting web.password_hash on load (a silent auth-integrity bug: $2a$10$N9qo8uL... -> "a0"). Remove both ExpandEnv calls; parse raw bytes. The typed applyEnvOverrides path (FELHOM_WEB_PASSWORD_HASH) is the sanctioned env mechanism and is unchanged. Tests + red-proof. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
Description
No description provided
Languages
Go
84.2%
HTML
11.1%
Shell
2.1%
CSS
1.8%
Python
0.6%
Other
0.1%