peter e4ac061721 feat(security): add baseline security response headers (E1 S4, SEC-1) ...

A small, safe set applied to every response via middleware: X-Content-Type-Options
nosniff, Referrer-Policy strict-origin-when-cross-origin, CSP frame-ancestors
'none' (anti-clickjacking; unrelated to the YouTube/Plex embeds we host), and
Permissions-Policy disabling camera/mic/geolocation. A full CSP and HSTS are
deferred (HSTS belongs on the Caddy edge).

2026-08-18 02:34:45 +02:00

..

alembic

test(migrations)+fix: widen drift check to column shape; notifications.created_at NOT NULL (S2 review #2)

2026-08-18 01:39:46 +02:00

app

feat(security): add baseline security response headers (E1 S4, SEC-1)

2026-08-18 02:34:45 +02:00

tests

test(migrations)+fix: widen drift check to column shape; notifications.created_at NOT NULL (S2 review #2)

2026-08-18 01:39:46 +02:00

alembic.ini

feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

2026-06-11 01:01:37 +02:00

docker-compose.test.yml

test(infra): fail-loud DB/ffmpeg lane + client/as_user/make_user fixtures (E1 S2, TEST-4)

2026-08-18 01:23:06 +02:00

Dockerfile

feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

2026-06-11 01:01:37 +02:00

Dockerfile.test

test(infra): fail-loud DB/ffmpeg lane + client/as_user/make_user fixtures (E1 S2, TEST-4)

2026-08-18 01:23:06 +02:00

entrypoint.sh

harden(auth): SA3 review follow-ups — IPv6-mapped match + no-proxy-headers guardrail

2026-07-12 03:49:08 +02:00

log_config.json

chore: rename remaining subfeed references to siftlode

2026-06-21 06:53:12 +02:00

pytest.ini

test(infra): fail-loud DB/ffmpeg lane + client/as_user/make_user fixtures (E1 S2, TEST-4)

2026-08-18 01:23:06 +02:00

requirements-dev.txt

test(backend): pin the traversal guard against a string-prefix bypass

2026-07-21 03:36:42 +02:00

requirements.txt

feat(downloads): Deno JS runtime + web/android clients to complete the POT setup

2026-07-03 22:46:32 +02:00

ruff.toml

chore(hygiene): Phase 4 guardrails — noUnusedLocals/Parameters + dead-code sweep

2026-07-12 02:15:52 +02:00