Endurecimiento de seguridad del starter (S-1: 22 tickets)#17

Merged

dherrero merged 24 commits into

mainfrom

feat/security-hardening-s1

Jun 10, 2026

Commits on Jun 9, 2026

fix(security): remove seeded ADMIN with known password; gate dev seed behind flag

dherrero
and
claude
committed
fix(security): reject soft-deleted users at authentication

dherrero
and
claude
committed
fix(security): allow-list writable fields to stop mass-assignment

dherrero
and
claude
committed
feat(security): add Zod input-validation layer at the API edge

dherrero
and
claude
committed
fix(security): re-read permissions on refresh rotation; bound remember

dherrero
and
claude
committed
feat(security): rate-limit gateway auth endpoints

dherrero
and
claude
committed
ci(security): make audit gate real and fix invalid job graph

dherrero
and
claude
committed
ci(security): harden release workflow against supply-chain abuse

dherrero
and
claude
committed
fix(security): bind dev Postgres to loopback only

dherrero
and
claude
committed
feat(security): wire auth guards to routes + add unauthorized page

dherrero
and
claude
committed
fix(security): validate post-login redirect against open redirect

dherrero
and
claude
committed
fix(security): only attach token/credentials to trusted origins

dherrero
and
claude
committed
fix(security): generate internal requestId server-side; strip client trust headers

dherrero
and
claude
committed
feat(security): add security headers (helmet + nginx CSP)

dherrero
and
claude
committed
fix(security): lock down API health detail endpoints

dherrero
and
claude
committed
fix(security): pass bcrypt cost as number; enforce minimum 12

dherrero
and
claude
committed
fix(security): filter deleted on put read-back + clamp pagination

dherrero
and
claude
committed
fix(security): logging hygiene — no bodies/PII/full errors in logs

dherrero
and
claude
committed
fix(security): pin nginx image + add clockTolerance to internal verify

dherrero
and
claude
committed
fix(security): harden gateway token flows (T-20)

dherrero
and
claude
committed
fix(security): fix tokenDecoded truthiness bug; document CSRF posture

dherrero
and
claude
committed
docs(security): document internal-token replay assumption (T-22)

dherrero
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Endurecimiento de seguridad del starter (S-1: 22 tickets)#17

Endurecimiento de seguridad del starter (S-1: 22 tickets)#17
dherrero merged 24 commits into
mainfrom
feat/security-hardening-s1

Commits on Jun 9, 2026

fix(security): remove seeded ADMIN with known password; gate dev seed behind flag

fix(security): reject soft-deleted users at authentication

fix(security): allow-list writable fields to stop mass-assignment

feat(security): add Zod input-validation layer at the API edge

fix(security): re-read permissions on refresh rotation; bound remember

feat(security): rate-limit gateway auth endpoints

ci(security): make audit gate real and fix invalid job graph

ci(security): harden release workflow against supply-chain abuse

fix(security): bind dev Postgres to loopback only

feat(security): wire auth guards to routes + add unauthorized page

fix(security): validate post-login redirect against open redirect

fix(security): only attach token/credentials to trusted origins

fix(security): generate internal requestId server-side; strip client trust headers

feat(security): add security headers (helmet + nginx CSP)

fix(security): lock down API health detail endpoints

fix(security): pass bcrypt cost as number; enforce minimum 12

fix(security): filter deleted on put read-back + clamp pagination

fix(security): logging hygiene — no bodies/PII/full errors in logs

fix(security): pin nginx image + add clockTolerance to internal verify

fix(security): harden gateway token flows (T-20)

fix(security): fix tokenDecoded truthiness bug; document CSRF posture

docs(security): document internal-token replay assumption (T-22)

Commits on Jun 10, 2026

chore: update package lock

style: fix prettier formatting in AGENTS.md and README_eng.md