Hugh Brown 8e145a2129 security: set sensible defaults for security response headers ...

X-Content-Type-Options, X-Frame-Options, and Referrer-Policy all
defaulted to empty (disabled). Set defaults to nosniff, DENY, and
strict-origin-when-cross-origin respectively. Operators can still
override or disable via environment variables.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-07 23:35:10 +05:30

..

api

security: require org-admin for gateway session message endpoint

2026-03-07 23:35:10 +05:30

core

security: set sensible defaults for security response headers

2026-03-07 23:35:10 +05:30

db

refactor: reorganize imports and improve code formatting for readability

2026-02-15 13:20:46 +05:30

models

security: add HMAC signature verification to webhook ingest

2026-03-07 23:35:10 +05:30

schemas

security: add HMAC signature verification to webhook ingest

2026-03-07 23:35:10 +05:30

services

security: require org-admin for gateway session message endpoint

2026-03-07 23:35:10 +05:30

__init__.py

refactor: update module docstrings for clarity and consistency

2026-02-09 15:49:50 +05:30

main.py

fix: make security headers configurable and add tests

2026-02-24 17:36:44 +01:00