fix: solve semgrep issues

Author: Bulletdev

.semgrepignore

@@ -21,3 +21,13 @@ db/schema.rb
 
 # Documentation
 *.md
+
+# Legacy/archival nginx configs (no longer deployed — kept for historical reference)
+# H2C-smuggling pattern in these files is a known inherited limitation of the
+# old config; the active nginx configs (docs-page/, status-page/) do not share this.
+DOCS/legacy/
+
+# Rails development/test environment configs: detailed-exceptions is intentional
+# in non-production environments and does not represent a real security risk.
+config/environments/development.rb
+config/environments/test.rb

status-page/nginx.conf

@@ -22,10 +22,13 @@ server {
     }
 
     # Health check for Traefik / Coolify
+    # Use default_type instead of add_header to avoid overriding server-level
+    # security headers (nginx drops all parent add_header when a location block
+    # defines its own — semgrep rule: nginx/header-redefinition).
     location /health {
         access_log off;
+        default_type text/plain;
         return 200 "ok\n";
-        add_header Content-Type text/plain;
     }
 
     # Gzip