3rd-audit remediation (F01-F25) + secretless browser/media worker (live)#456

Merged

MikeyPetrillo merged 11 commits into

mainfrom

claude/sweet-brown-i99jl3

Jul 19, 2026

Commits on Jul 19, 2026

[test][deploy] 3rd-audit batch A: F07 F09 F10 F16 F20 F24

MikeyPetrillo
and
claude
committed
[test][deploy] 3rd-audit batch B: F03 F12 F14 F15 (+ F07 CI fix)

MikeyPetrillo
and
claude
committed
[test][deploy] 3rd-audit batch C: Tollbooth F05 F18 F19

MikeyPetrillo
and
claude
committed
F01 (code half): CODEOWNERS + production environment ref on deploy/publish

MikeyPetrillo
and
claude
committed
[test][deploy] 3rd-audit F08 + F23: narrow Gitleaks excludes, href scheme guard

MikeyPetrillo
and
claude
committed
[test][deploy] F02/F04/F06: secretless browser+media worker (flagged OFF)

MikeyPetrillo
and
claude
committed
[test][deploy] F11: route-aware Postgres TLS (verify on public, relaxed on private mesh)

MikeyPetrillo
and
claude
committed
worker: bind IPv6 :: for Railway private networking; F13 options writeup

MikeyPetrillo
and
claude
committed
add railway.worker.json (worker service config: Dockerfile.worker)

MikeyPetrillo
and
claude
committed
[test][deploy] F04: validating+pinning egress proxy in the browser worker

MikeyPetrillo
and
claude
committed
[test][deploy] worker: single shared image, WORKER_MODE env selects it (fix failed build)

MikeyPetrillo
and
claude
committed