feat(security): prod-readiness PR 1 of 5 — bearer auth, security headers, error envelope#106

Merged

aksOps merged 10 commits into

mainfrom

feat/prod-ready-1-security

Apr 28, 2026

Commits on Apr 28, 2026

chore(deps): bump Node from v20.11.0 to v22.12.0 for Vite 8 (unblocks #86)

aksOps
and
claude
committed
checkpoint: pre-yolo 2026-04-28T07:25:13
aksOps
committed
feat(security): production-readiness PR 1 — bearer auth, security headers, error envelope

aksOps
and
claude
committed
fix(cors): update CorsConfigTest for new deny-all default; constructor injection

aksOps
and
claude
committed
fix(security): scrub IOException details from /api/file responses (CodeQL CWE-209)

aksOps
and
claude
committed
fix(security): apply CodeQL log-injection + sensitive-log + CSRF hardening

aksOps
and
claude
committed
feat(limits): production-readiness PR 2 — resource limits & abuse protection (#107)

aksOps
and
claude
authored
fix(security): sanitize request method/URI in RateLimitFilter log (CWE-117)

aksOps
and
claude
committed
fix(security): use ignoringRequestMatchers('/**') instead of csrf().disable()

aksOps
and
claude
committed
fix(security): use UTF-8 charset in RateLimitFilter.sha256Short (SpotBugs DM_DEFAULT_ENCODING)

aksOps
and
claude
committed