7d20dbb12f
Two new OpenSpec changes: - observability (30 tasks): health endpoints, Prometheus, Grafana+Loki, structured logging, dashboards, alerting - security-hardening (24 tasks): Caddy headers, scanner blocking, gitleaks, pnpm audit, dependabot, non-root Docker, fail2ban Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1.7 KiB
1.7 KiB
Why
A security audit found several gaps: no security headers (HSTS, CSP, etc.),
no secret scanning in CI, no dependency vulnerability scanning, Docker
containers running as root, and bot scanners probing for .env files with
no filtering. The cookie and auth setup is solid, but the infrastructure and
CI layers need hardening.
What Changes
- Security headers: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy via Caddyfile
- Content-Security-Policy: Restrict script/style/font sources
- Gitleaks: Secret scanning in CI to prevent credential leaks
- Dependency auditing:
pnpm auditin CI + Dependabot for automated updates - Docker hardening: Non-root user in all Dockerfiles
- Bot/scanner blocking: Caddy matcher to reject known scanner paths
(
.env,.git,wp-config, etc.) with 403 before hitting the app - Fail2ban or equivalent: Rate-limit SSH brute force and scanner IPs at the server level
- SECURITY.md: Vulnerability disclosure policy
Capabilities
New Capabilities
security-hardening: Security headers, CI secret/dependency scanning, Docker non-root, scanner blocking, server-level rate limiting
Modified Capabilities
infrastructure: Caddy security headers + scanner blocking, Docker non-root, Terraform firewall adjustments, CI scanning steps
Impact
- Caddyfile: Security headers + scanner path blocking
- Dockerfiles: Add non-root user (journal, planner, brouter)
- CI: Add gitleaks step, pnpm audit step
- Repo: Add
.gitleaks.toml,dependabot.yml,SECURITY.md - Server: Optional fail2ban or UFW configuration
- Dependencies: None for app code; gitleaks is a CI action