trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security hardening: headers, scanning, Docker, firewall

Browse source 
- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy,
  Permissions-Policy on all responses
- Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403
- CI: Gitleaks secret scanning + pnpm audit for vulnerabilities
- Dependabot: Weekly npm + GitHub Actions + monthly Docker updates
- Docker: Non-root user in journal, planner, and brouter containers
- Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned)
- SECURITY.md: Vulnerability disclosure policy
- Privacy page: Security practices section added

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-03-25 09:58:12 +01:00
parent 0499133982
commit be3e69c10b
No known key found for this signature in database
GPG key ID: A32FF691A0F752D9
11 changed files with 211 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

7
.gitleaks.toml Normal file
View file

@ -0,0 +1,7 @@
[extend]
# Use default gitleaks rules
[[allowlist.regexTarget]]
# Sentry DSNs are public (ingest-only, not secrets)
description = "Sentry DSN"
regex = '''https://[a-f0-9]+@o\d+\.ingest\.\w+\.sentry\.io/\d+'''