security: Harden server, auth, rate limiting, and proxy config#78

Merged

0xFelix merged 8 commits intomainfrom

security-hardening

Apr 18, 2026

Commits on Apr 17, 2026

container: Run as non-root UID

0xFelix
and
claude
committed

Commits on Apr 18, 2026

server: Add HTTP read/write/idle timeouts

0xFelix
and
claude
committed
ratelimit: Cap limiter bucket count to bound memory

0xFelix
and
claude
committed
ratelimit: Cap lockout entry count to bound memory

0xFelix
and
claude
committed
middleware: Harden debug request logging

0xFelix
and
claude
committed
middleware: Lockout and constant-time compare on user auth

0xFelix
and
claude
committed
config: Support CIDR ranges in trustedProxies

0xFelix
and
claude
committed
docs: Document security notes, auth behavior, and trustedProxies CIDR

0xFelix
and
claude
committed