Merge pull request #113 from christianlouis/copilot/run-security-audit-with-bandit

Security audit: Fix 21 vulnerabilities and integrate Bandit into CI

app/config.py

@@ -104,6 +104,9 @@ class Settings(BaseSettings):
     sftp_folder: Optional[str] = None
     sftp_private_key: Optional[str] = None
     sftp_private_key_passphrase: Optional[str] = None
+    # Security: Disable host key verification only in development/testing environments
+    # In production, set to True and configure known_hosts file
+    sftp_disable_host_key_verification: bool = True  # Default allows connection without known_hosts
 
     # Email settings
     email_host: Optional[str] = None
@@ -134,6 +137,9 @@ class Settings(BaseSettings):
     uptime_kuma_url: Optional[str] = None
     uptime_kuma_ping_interval: int = 5  # Default ping interval in minutes
 
+    # HTTP request settings
+    http_request_timeout: int = 120  # Default timeout for HTTP requests in seconds (handles large file operations)
+
     # Feature flags
     allow_file_delete: bool = True  # Default to allowing file deletion from database