pook/compliancebot

Fork 0

Add security headers middleware — HSTS, X-Content-Type-Options, X-Frame-Options #73

New issue

Closed

opened 2026-04-08 17:04:14 -04:00 by pook · 1 comment

pook commented

2026-04-08 17:04:14 -04:00

Owner

Stale issue #39 (CORS + security headers) is too broad. This task adds only the security headers, which are critical and have no configuration complexity.

Implement:

Add middleware that sets on every response:
- Strict-Transport-Security: max-age=31536000; includeSubDomains
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- X-XSS-Protection: 0 (modern best practice — rely on CSP instead)
- Referrer-Policy: strict-origin-when-cross-origin
Apply before route handlers

Acceptance criteria:

All 5 headers present on every HTTP response
Headers verified via unit test asserting response header values
No CORS logic included (separate task)
Middleware is a single function exportable for reuse

Generated by CEO Planner (priority: 3)

Stale issue #39 (CORS + security headers) is too broad. This task adds only the security headers, which are critical and have no configuration complexity. Implement: 1. Add middleware that sets on every response: - Strict-Transport-Security: max-age=31536000; includeSubDomains - X-Content-Type-Options: nosniff - X-Frame-Options: DENY - X-XSS-Protection: 0 (modern best practice — rely on CSP instead) - Referrer-Policy: strict-origin-when-cross-origin 2. Apply before route handlers Acceptance criteria: - All 5 headers present on every HTTP response - Headers verified via unit test asserting response header values - No CORS logic included (separate task) - Middleware is a single function exportable for reuse --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-08 17:04:14 -04:00

pook referenced this issue

2026-04-08 21:51:49 -04:00

Close stale issues superseded by newer scoped issues — #37, #38, #39, #42, #53 #145

pook referenced this issue

2026-04-08 21:53:04 -04:00

Add CORS configuration and security headers middleware #39

pook referenced this issue

2026-04-08 21:53:15 -04:00

[Agent] Issue #145: multiple stale issues 11h are duplicates #146

pook referenced this issue

2026-04-09 02:41:11 -04:00

Add Helmet security headers middleware to Express app #199

agent-bot referenced this issue from a commit

2026-04-09 02:43:27 -04:00

feat: add security headers middleware (HSTS, CSP, X-Frame-Options)

pook referenced this issue from a pull request that will close it,

2026-04-09 02:44:52 -04:00

feat: add security headers middleware (HSTS, CSP, X-Frame-Options) #201

pook commented

2026-04-10 14:48:30 -04:00

Author

Owner

Bulk-closed 2026-04-10 during pipeline triage.

Context: CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch agent/dispatch/* because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key.

What to do next:

Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge
CEO should halt new task creation until open PRs drop below 10
Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks)

This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

Bulk-closed 2026-04-10 during pipeline triage. **Context:** CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch `agent/dispatch/*` because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key. **What to do next:** 1. Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge 2. CEO should halt new task creation until open PRs drop below 10 3. Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks) This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

pook closed this issue

2026-04-10 14:48:30 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#73

No description provided.

Rows
Columns