sneak c95ac471f1 Add the HTTP hardening the policy requires before 1.0 (closes #108) ...

Every answer carries the six security headers REPO_POLICIES.md lists.
The Content-Security-Policy allows inline content only with a nonce made
for that answer; the pages put it on their style and script blocks and
drop their four style attributes.

The request log and /ip/ take a forwarded address only from a proxy
listed in TRUSTED_PROXIES, which stops the start when set but invalid:
the last X-Forwarded-For entry that is not a trusted proxy. X-Real-IP
and True-Client-IP are no longer read.

The JSON routes and the health check send fixed messages in place of
database, parser and resolver errors, and log the detail.

Model: opus-5-5

2026-10-19 23:24:27 +00:00

..

handlers_internal_test.go

Add the HTTP hardening the policy requires before 1.0 (closes #108)

2026-10-19 23:24:27 +00:00

handlers.go

Add the HTTP hardening the policy requires before 1.0 (closes #108)

2026-10-19 23:24:27 +00:00

middleware_internal_test.go

Add the HTTP hardening the policy requires before 1.0 (closes #108)

2026-10-19 23:24:27 +00:00

middleware.go

Add the HTTP hardening the policy requires before 1.0 (closes #108)

2026-10-19 23:24:27 +00:00

routes.go

Add the HTTP hardening the policy requires before 1.0 (closes #108)

2026-10-19 23:24:27 +00:00

server_test.go

Re-vendor the shared files from sneak/prompts at 0653579 (closes #52)

2026-10-19 12:10:11 +02:00

server.go

Add the HTTP hardening the policy requires before 1.0 (closes #108)

2026-10-19 23:24:27 +00:00