fix: 3 security fixes#1

Open

androw wants to merge 3 commits into

Panos1221:masterfrom

Commits on May 13, 2026

fix: escape HTML in health dashboard event log to prevent stored XSS

androw
and
claude
committed
fix: escape user.name and distance in Mapbox marker to prevent DOM XSS

androw
and
claude
committed
fix: require HEALTH_PASSWORD at startup to prevent auth bypass

androw
and
claude
committed