be3e69c10b
- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy on all responses - Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403 - CI: Gitleaks secret scanning + pnpm audit for vulnerabilities - Dependabot: Weekly npm + GitHub Actions + monthly Docker updates - Docker: Non-root user in journal, planner, and brouter containers - Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned) - SECURITY.md: Vulnerability disclosure policy - Privacy page: Security practices section added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
30 lines
629 B
YAML
30 lines
629 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
groups:
|
|
production:
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
development:
|
|
dependency-type: "development"
|
|
open-pull-requests-limit: 10
|
|
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
|
|
- package-ecosystem: "docker"
|
|
directory: "/apps/journal"
|
|
schedule:
|
|
interval: "monthly"
|
|
|
|
- package-ecosystem: "docker"
|
|
directory: "/apps/planner"
|
|
schedule:
|
|
interval: "monthly"
|