be3e69c10b
- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy on all responses - Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403 - CI: Gitleaks secret scanning + pnpm audit for vulnerabilities - Dependabot: Weekly npm + GitHub Actions + monthly Docker updates - Docker: Non-root user in journal, planner, and brouter containers - Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned) - SECURITY.md: Vulnerability disclosure policy - Privacy page: Security practices section added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
7 lines
210 B
TOML
7 lines
210 B
TOML
[extend]
|
|
# Use default gitleaks rules
|
|
|
|
[[allowlist.regexTarget]]
|
|
# Sentry DSNs are public (ingest-only, not secrets)
|
|
description = "Sentry DSN"
|
|
regex = '''https://[a-f0-9]+@o\d+\.ingest\.\w+\.sentry\.io/\d+'''
|