Add Helmet.js HTTP security headers to Express app #988

New issue

Open

opened 2026-04-12 07:03:43 -04:00 by pook · 0 comments

pook commented

2026-04-12 07:03:43 -04:00

Owner

Add Helmet.js middleware to the Express application for production HTTP security headers.

Context: Contractpilot has this covered via PR #696, but compliancebot has no Helmet.js issue or PR. Both apps share similar architecture and attack surface. Without security headers, the app is vulnerable to clickjacking (no X-Frame-Options), MIME sniffing (no X-Content-Type-Options), and other header-based attacks.

Acceptance criteria:

Install helmet package
Add app.use(helmet()) early in middleware chain (before routes)
Configure Content-Security-Policy to allow only necessary sources (self for scripts/styles, Stripe JS if loaded client-side)
Set referrer-policy to 'strict-origin-when-cross-origin'
Ensure Helmet does NOT break existing /api/generate endpoint (test that JSON responses still work)
Ensure Helmet does NOT interfere with Stripe webhook endpoint
Verify headers in test: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Strict-Transport-Security present

Generated by CEO Planner (priority: 2)

Add Helmet.js middleware to the Express application for production HTTP security headers. Context: Contractpilot has this covered via PR #696, but compliancebot has no Helmet.js issue or PR. Both apps share similar architecture and attack surface. Without security headers, the app is vulnerable to clickjacking (no X-Frame-Options), MIME sniffing (no X-Content-Type-Options), and other header-based attacks. Acceptance criteria: - Install `helmet` package - Add `app.use(helmet())` early in middleware chain (before routes) - Configure Content-Security-Policy to allow only necessary sources (self for scripts/styles, Stripe JS if loaded client-side) - Set referrer-policy to 'strict-origin-when-cross-origin' - Ensure Helmet does NOT break existing /api/generate endpoint (test that JSON responses still work) - Ensure Helmet does NOT interfere with Stripe webhook endpoint - Verify headers in test: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Strict-Transport-Security present --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-12 07:03:43 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#988

No description provided.

Rows
Columns