Dorian 12ae3af981 feat: Phase 6 — nginx security headers, CSP hardening, rate limiting ...

- CSP: removed unsafe-eval, tightened frame-src to self + host ports,
  added frame-ancestors, base-uri, form-action directives
- X-Frame-Options: SAMEORIGIN added after proxy_hide_header on all app proxies
- HSTS: max-age=31536000; includeSubDomains on all server blocks
- Rate limiting: 20r/s on /rpc/ with burst=40, 3r/s auth zone
- Added X-DNS-Prefetch-Control, Permissions-Policy payment=() header

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-18 00:57:16 +00:00

..

Old Plans

fix: resolve did:dht compilation errors

2026-03-14 04:14:04 +00:00

pentest

chore: add security pentest reports and remediation plan

2026-03-06 03:08:14 +00:00

loop.sh

chore: add pentest-fix prompt and wire verification into loop.sh

2026-03-06 03:53:36 +00:00

pentest.yaml

chore: add security pentest reports and remediation plan

2026-03-06 03:08:14 +00:00

plan.md

feat: Phase 6 — nginx security headers, CSP hardening, rate limiting

2026-03-18 00:57:16 +00:00

prepare.sh

feat: AIUI chat mode integration with iframe, context broker, overnight loop

2026-03-04 12:06:20 +00:00

prompt-pentest-fix.md

chore: add pentest-fix prompt and wire verification into loop.sh

2026-03-06 03:53:36 +00:00

prompt.md

fix: add 6 missing apps to first-boot and fix penpot icon path

2026-03-09 00:18:28 +00:00

testing.md

fix: zero-amount invoices, identity.verify DID extraction, tor service permissions

2026-03-09 09:53:36 +00:00