Fix picomatch audit vulnerability and complete security hardening verification

Override picomatch to 4.0.4 to resolve high-severity ReDoS (GHSA-c2c7-rcm5-vvqj),
verify all security hardening tasks (gitleaks, pnpm audit, Docker non-root,
Caddy headers, scanner blocking), sync specs, and archive the change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openspec/changes/archive/2026-03-26-security-hardening/tasks.md

@@ -2,32 +2,32 @@
 
 - [x] 1.1 Add security headers block to Caddyfile: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
 - [x] 1.2 Add Content-Security-Policy header (permissive initial policy allowing React Router inline scripts, OSM tiles, Sentry, WebSocket)
-- [ ] 1.3 Test headers with securityheaders.com or curl after deploy
+- [x] 1.3 Test headers with securityheaders.com or curl after deploy
 
 ## 2. Scanner Blocking
 
 - [x] 2.1 Add Caddy path matcher for common scanner targets (.env*, .git*, wp-*, admin*, config.*, backup*)
 - [x] 2.2 Return 403 for matched paths before reverse_proxy
-- [ ] 2.3 Verify scanner paths return 403, normal paths still work
+- [x] 2.3 Verify scanner paths return 403, normal paths still work
 
 ## 3. CI Secret Scanning
 
 - [x] 3.1 Add gitleaks/gitleaks-action@v2 step to CI workflow
 - [x] 3.2 Create .gitleaks.toml with allowlist for Sentry DSNs (public values)
-- [ ] 3.3 Verify gitleaks passes on current codebase
+- [x] 3.3 Verify gitleaks passes on current codebase
 
 ## 4. Dependency Auditing
 
 - [x] 4.1 Add `pnpm audit --audit-level=high` step to CI workflow
 - [x] 4.2 Create .github/dependabot.yml for weekly pnpm dependency updates
-- [ ] 4.3 Verify pnpm audit passes on current codebase
+- [x] 4.3 Verify pnpm audit passes on current codebase
 
 ## 5. Docker Hardening
 
 - [x] 5.1 Add non-root user to Journal Dockerfile runtime stage
 - [x] 5.2 Add non-root user to Planner Dockerfile runtime stage
 - [x] 5.3 Add non-root user to BRouter Dockerfile
-- [ ] 5.4 Test containers start and serve correctly as non-root
+- [x] 5.4 Test containers start and serve correctly as non-root
 
 ## 6. Server Hardening
 
@@ -42,7 +42,7 @@
 
 ## 8. Verify
 
-- [ ] 8.1 Run securityheaders.com scan on trails.cool and planner.trails.cool
-- [ ] 8.2 Verify scanner paths return 403 in production
-- [ ] 8.3 Verify CI passes with all new scanning steps
-- [ ] 8.4 Verify Docker containers run as non-root
+- [x] 8.1 Run securityheaders.com scan on trails.cool and planner.trails.cool
+- [x] 8.2 Verify scanner paths return 403 in production
+- [x] 8.3 Verify CI passes with all new scanning steps
+- [x] 8.4 Verify Docker containers run as non-root

openspec/specs/infrastructure/spec.md

@@ -15,7 +15,7 @@ All services SHALL be deployed via Docker Compose on the Hetzner server.
 - **THEN** the Journal, Planner, BRouter, PostgreSQL, and Garage containers start and are reachable
 
 ### Requirement: Service configuration
-Each service SHALL be configured via environment variables defined in Docker Compose.
+Each service SHALL be configured via environment variables defined in Docker Compose, with security best practices including non-root execution and security headers.
 
 #### Scenario: Journal configuration
 - **WHEN** the Journal container starts
@@ -25,6 +25,14 @@ Each service SHALL be configured via environment variables defined in Docker Com
 - **WHEN** the Planner container starts
 - **THEN** it reads BROUTER_URL and DATABASE_URL from environment variables
 
+#### Scenario: Caddy security headers
+- **WHEN** Caddy proxies a request
+- **THEN** it adds HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers
+
+#### Scenario: Caddy scanner blocking
+- **WHEN** a request matches known scanner paths (.env, .git, wp-config, etc.)
+- **THEN** Caddy returns 403 without forwarding to the application
+
 ### Requirement: PostgreSQL with PostGIS
 The database SHALL be PostgreSQL with the PostGIS extension for spatial queries.
 
@@ -44,12 +52,20 @@ The infrastructure SHALL support downloading and updating Germany RD5 segments f
 - **THEN** RD5 segments are updated from brouter.de and the BRouter container is restarted
 
 ### Requirement: CI/CD pipeline
-GitHub Actions SHALL build and deploy both apps on push to main.
+GitHub Actions SHALL build, deploy, and security-scan both apps on push to main.
 
 #### Scenario: Push triggers deployment
 - **WHEN** code is pushed to the main branch
 - **THEN** GitHub Actions builds Docker images, pushes to ghcr.io/trails-cool/, and deploys to the Hetzner server
 
+#### Scenario: Gitleaks scan
+- **WHEN** a PR is opened
+- **THEN** gitleaks scans for committed secrets
+
+#### Scenario: Dependency audit
+- **WHEN** CI runs
+- **THEN** pnpm audit checks for high/critical vulnerabilities
+
 ### Requirement: Backup strategy
 The infrastructure SHALL include daily backups of the PostgreSQL database.
 

openspec/specs/security-hardening/spec.md

@@ -0,0 +1,59 @@
+## Requirements
+
+### Requirement: Security response headers
+All HTTP responses SHALL include security headers to protect against common web attacks.
+
+#### Scenario: HSTS header
+- **WHEN** a browser receives a response from trails.cool
+- **THEN** the response includes `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
+
+#### Scenario: Content sniffing prevention
+- **WHEN** a browser receives a response
+- **THEN** the response includes `X-Content-Type-Options: nosniff`
+
+#### Scenario: Clickjacking prevention
+- **WHEN** a browser receives a response
+- **THEN** the response includes `X-Frame-Options: DENY`
+
+### Requirement: Scanner path blocking
+Known vulnerability scanner paths SHALL be blocked at the reverse proxy level before reaching the application.
+
+#### Scenario: Env file scanner
+- **WHEN** a request is made to `/.env`, `/.env.local`, `/.env.prod`, or similar paths
+- **THEN** Caddy returns 403 without forwarding to the application
+
+#### Scenario: Git config scanner
+- **WHEN** a request is made to `/.git/config` or `/.git/HEAD`
+- **THEN** Caddy returns 403 without forwarding to the application
+
+### Requirement: Secret scanning in CI
+The CI pipeline SHALL scan commits for accidentally committed secrets.
+
+#### Scenario: Secret detected
+- **WHEN** a PR contains a committed API key, token, or password
+- **THEN** the CI pipeline fails with a clear message indicating the leaked secret
+
+#### Scenario: Known public values allowed
+- **WHEN** a known-public value (e.g., Sentry DSN) is committed
+- **THEN** gitleaks allows it via the `.gitleaks.toml` allowlist
+
+### Requirement: Dependency vulnerability scanning
+The CI pipeline SHALL check for known vulnerabilities in dependencies.
+
+#### Scenario: High severity vulnerability
+- **WHEN** a dependency has a high or critical vulnerability advisory
+- **THEN** the CI pipeline fails
+
+### Requirement: Non-root Docker containers
+Application containers SHALL run as a non-root user.
+
+#### Scenario: Container user
+- **WHEN** a container starts
+- **THEN** the process runs as a non-root user (not UID 0)
+
+### Requirement: Vulnerability disclosure policy
+The repository SHALL include a SECURITY.md with responsible disclosure instructions.
+
+#### Scenario: Security contact
+- **WHEN** a security researcher finds a vulnerability
+- **THEN** SECURITY.md provides clear instructions for reporting it