trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/openspec/changes/security-hardening/specs/infrastructure/spec.md
Ullrich Schäfer 7d20dbb12f
Add observability and security-hardening proposals, gitignore settings.local 
Two new OpenSpec changes:
- observability (30 tasks): health endpoints, Prometheus, Grafana+Loki,
  structured logging, dashboards, alerting
- security-hardening (24 tasks): Caddy headers, scanner blocking,
  gitleaks, pnpm audit, dependabot, non-root Docker, fail2ban

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-25 09:48:08 +01:00

882 B
Raw Blame History

MODIFIED Requirements

Requirement: Service configuration

Each service SHALL be configured with security best practices including non-root execution and security headers.

Scenario: Caddy security headers

  • WHEN Caddy proxies a request
  • THEN it adds HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers

Scenario: Caddy scanner blocking

  • WHEN a request matches known scanner paths (.env, .git, wp-config, etc.)
  • THEN Caddy returns 403 without forwarding to the application

Requirement: CI/CD pipeline

GitHub Actions SHALL include security scanning steps alongside build and test.

Scenario: Gitleaks scan

  • WHEN a PR is opened
  • THEN gitleaks scans for committed secrets

Scenario: Dependency audit

  • WHEN CI runs
  • THEN pnpm audit checks for high/critical vulnerabilities