Implement critical security fixes: secret management, XML parsing, auth, input validation, security headers

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.env.example

@@ -5,18 +5,32 @@
 
 # Application Settings
 PROJECT_NAME="DMARQ"
+
+# SECURITY: Generate a secure random secret key
+# Use: openssl rand -hex 32
+# NEVER use the default value in production!
 SECRET_KEY="CHANGE_THIS_TO_A_RANDOM_SECRET_IN_PRODUCTION"
 
+# Environment (development/production)
+# Affects HSTS and other security settings
+ENVIRONMENT="development"
+
 # Database
 DATABASE_URL="sqlite:///./dmarq.db"
+# For production, use PostgreSQL:
+# DATABASE_URL="postgresql://user:password@localhost/dmarq"
 
 # IMAP Settings for DMARC Report Retrieval
 IMAP_SERVER="mail.example.com"  # Required for IMAP polling
 IMAP_PORT=993                   # Default for SSL
 IMAP_USERNAME="dmarc@example.com"
 IMAP_PASSWORD="your_imap_password" # Consider using a secrets manager in production
+
 # CORS Origins (comma separated)
+# SECURITY: Be specific - avoid wildcards in production
 BACKEND_CORS_ORIGINS="http://localhost:3000,http://localhost:5173"
+# For production:
+# BACKEND_CORS_ORIGINS="https://yourdomain.com"
 
 # Admin User (first-time setup)
 FIRST_SUPERUSER="admin@example.com"