b6908fb288
Override picomatch to 4.0.4 to resolve high-severity ReDoS (GHSA-c2c7-rcm5-vvqj), verify all security hardening tasks (gitleaks, pnpm audit, Docker non-root, Caddy headers, scanner blocking), sync specs, and archive the change. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1.7 KiB
1.7 KiB
Why
A security audit found several gaps: no security headers (HSTS, CSP, etc.),
no secret scanning in CI, no dependency vulnerability scanning, Docker
containers running as root, and bot scanners probing for .env files with
no filtering. The cookie and auth setup is solid, but the infrastructure and
CI layers need hardening.
What Changes
- Security headers: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy via Caddyfile
- Content-Security-Policy: Restrict script/style/font sources
- Gitleaks: Secret scanning in CI to prevent credential leaks
- Dependency auditing:
pnpm auditin CI + Dependabot for automated updates - Docker hardening: Non-root user in all Dockerfiles
- Bot/scanner blocking: Caddy matcher to reject known scanner paths
(
.env,.git,wp-config, etc.) with 403 before hitting the app - Fail2ban or equivalent: Rate-limit SSH brute force and scanner IPs at the server level
- SECURITY.md: Vulnerability disclosure policy
Capabilities
New Capabilities
security-hardening: Security headers, CI secret/dependency scanning, Docker non-root, scanner blocking, server-level rate limiting
Modified Capabilities
infrastructure: Caddy security headers + scanner blocking, Docker non-root, Terraform firewall adjustments, CI scanning steps
Impact
- Caddyfile: Security headers + scanner path blocking
- Dockerfiles: Add non-root user (journal, planner, brouter)
- CI: Add gitleaks step, pnpm audit step
- Repo: Add
.gitleaks.toml,dependabot.yml,SECURITY.md - Server: Optional fail2ban or UFW configuration
- Dependencies: None for app code; gitleaks is a CI action