05/02/2026 updated code for security 2

app/models/user.py

@@ -1,4 +1,4 @@
-from datetime import datetime
+from datetime import datetime, timezone
 from flask_login import UserMixin
 from argon2 import PasswordHasher
 from argon2.exceptions import VerifyMismatchError, VerificationError, InvalidHashError
@@ -19,7 +19,7 @@ class User(db.Model, UserMixin):
     # Returned to the client on login so it can re-derive the AES-256-GCM vault key.
     # The server never uses this for decryption — it is opaque to us.
     enc_key_salt = db.Column(db.String(64), nullable=False)
-    created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
+    created_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc).replace(tzinfo=None), nullable=False)
     last_login = db.Column(db.DateTime, nullable=True)
     # TOTP / MFA
     # totp_secret: AES-256-GCM ciphertext of the base32 TOTP secret, base64-encoded.
@@ -60,4 +60,4 @@ class User(db.Model, UserMixin):
             return False
 
     def __repr__(self):
-        return f'<User {self.email}>'
+        return f'<User {self.email}>'