trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/openspec/changes/archive/2026-03-26-security-hardening/specs/infrastructure/spec.md
Ullrich Schäfer b6908fb288
Fix picomatch audit vulnerability and complete security hardening verification 
Override picomatch to 4.0.4 to resolve high-severity ReDoS (GHSA-c2c7-rcm5-vvqj),
verify all security hardening tasks (gitleaks, pnpm audit, Docker non-root,
Caddy headers, scanner blocking), sync specs, and archive the change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 00:31:27 +01:00

882 B
Raw Blame History

MODIFIED Requirements

Requirement: Service configuration

Each service SHALL be configured with security best practices including non-root execution and security headers.

Scenario: Caddy security headers

  • WHEN Caddy proxies a request
  • THEN it adds HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers

Scenario: Caddy scanner blocking

  • WHEN a request matches known scanner paths (.env, .git, wp-config, etc.)
  • THEN Caddy returns 403 without forwarding to the application

Requirement: CI/CD pipeline

GitHub Actions SHALL include security scanning steps alongside build and test.

Scenario: Gitleaks scan

  • WHEN a PR is opened
  • THEN gitleaks scans for committed secrets

Scenario: Dependency audit

  • WHEN CI runs
  • THEN pnpm audit checks for high/critical vulnerabilities