pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

feat: add security headers middleware (HSTS, CSP, X-Frame-Options) #201

Closed
pook wants to merge 2 commits from feat/security-headers-v2 into main
pull from: feat/security-headers-v2
merge into: pook:main
Conversation 1 Commits 2 Files changed 6 +431
pook commented 2026-04-09 02:44:52 -04:00
Owner
Copy link

Summary

  • Adds Hono middleware setting HSTS, X-Content-Type-Options (nosniff), X-Frame-Options (DENY), restrictive CSP, Referrer-Policy, and Permissions-Policy on all API responses
  • Middleware registered before route handlers in packages/api/src/index.ts
  • E2E test suite verifying all security headers on both success and 404 responses

Closes #73

Test plan

  • bun test packages/api/tests/e2e/security-headers.test.ts — all 7 assertions pass
  • Existing E2E tests still pass (no middleware conflicts)
  • curl -I http://localhost:3100/health shows all security headers

🤖 Generated with Claude Code

## Summary - Adds Hono middleware setting HSTS, X-Content-Type-Options (`nosniff`), X-Frame-Options (`DENY`), restrictive CSP, Referrer-Policy, and Permissions-Policy on all API responses - Middleware registered before route handlers in `packages/api/src/index.ts` - E2E test suite verifying all security headers on both success and 404 responses Closes #73 ## Test plan - [ ] `bun test packages/api/tests/e2e/security-headers.test.ts` — all 7 assertions pass - [ ] Existing E2E tests still pass (no middleware conflicts) - [ ] `curl -I http://localhost:3100/health` shows all security headers 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Adds Hono middleware setting Strict-Transport-Security, X-Content-Type-Options,
X-Frame-Options, Content-Security-Policy, Referrer-Policy, and Permissions-Policy
on all API responses. Includes E2E tests verifying headers on success and 404 responses.

Closes #73

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
pook commented 2026-04-10 15:06:06 -04:00
Author
Owner
Copy link

Closed 2026-04-10 during pipeline triage.

Merge conflicts with current main were blocking the CEO agent's backlog view. Reopen / resubmit against current main if the work is still relevant — CEO now injects open issues/PRs into its prompt and avoids duplicating.

Closed 2026-04-10 during pipeline triage. Merge conflicts with current main were blocking the CEO agent's backlog view. Reopen / resubmit against current main if the work is still relevant — CEO now injects open issues/PRs into its prompt and avoids duplicating.
pook closed this pull request 2026-04-10 15:06:06 -04:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!201
No description provided.