fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/useCases/ResetPassword.go

@@ -35,6 +35,10 @@ func (r *ResetPasswordUseCase) ResetPassword(ctx context.Context, email string,
 		return user.ErrPasswordResetCodeExpired
 	}
 
+	if err := user.ValidatePassword(newPassword); err != nil {
+		return err
+	}
+
 	hashedPassword, err := r.hasher.Hash(newPassword)
 	if err != nil {
 		return err