fix(security): pre-release hardening batch — 8 SDD-specced fixes#584

Merged

remyluslosius merged 11 commits into

mainfrom

feat/security-hardening

Jun 17, 2026

Commits on Jun 16, 2026

fix(security): require audit:read on GET /audit/events (was anonymous)
remyluslosius
committed
fix(security): block API-token privilege escalation (role must be within caller's grant)
remyluslosius
committed
fix(security): subset check on role assignment (anti-escalation)
remyluslosius
committed
fix(security): add security response headers (CSP, HSTS, nosniff, frame-deny)
remyluslosius
committed
fix(security): enable the breach-password check in production (was nil corpus)
remyluslosius
committed
test(security): authenticate the remaining /audit/events test callers
remyluslosius
committed
docs(security): pre-release security review (6-dimension audit + verdict)
remyluslosius
committed
fix(security): rate-limit the authentication endpoints (B-2)
remyluslosius
committed

Commits on Jun 17, 2026