feat: add security hardening (Helmet, Zod, CORS, API key auto-gen) #339

Merged

review.bot merged 1 commit from feat/329-api-auth-rate-limiting into develop

2026-03-02 13:04:05 +00:00

jack commented

2026-03-02 13:03:59 +00:00

Owner

Summary

Add Helmet.js security headers (CSP, X-Frame-Options, X-Content-Type-Options)
Add Zod input validation on hooks routes (session start/end, prompt, observation, user tasks)
Add configurable CORS origins via CORS_ORIGINS setting (comma-separated)
Add API key auto-generation on first start (API_KEY_AUTO_GENERATE setting)
Add validateBody/validateQuery middleware for reusable validation

Note: API-Key auth and rate-limiting were already implemented — this PR adds the remaining security layers.

Closes #329

## Summary - Add Helmet.js security headers (CSP, X-Frame-Options, X-Content-Type-Options) - Add Zod input validation on hooks routes (session start/end, prompt, observation, user tasks) - Add configurable CORS origins via `CORS_ORIGINS` setting (comma-separated) - Add API key auto-generation on first start (`API_KEY_AUTO_GENERATE` setting) - Add `validateBody`/`validateQuery` middleware for reusable validation Note: API-Key auth and rate-limiting were already implemented — this PR adds the remaining security layers. Closes #329

jack added 1 commit

2026-03-02 13:03:59 +00:00

feat: add security hardening with Helmet, Zod validation, CORS config, and API key auto-generation 8816d3862f

- Add Helmet.js security headers (CSP, X-Frame-Options, etc.)
- Add Zod input validation on hooks routes (session, prompt, observation)
- Add configurable CORS origins via CORS_ORIGINS setting
- Add API key auto-generation on first start (API_KEY_AUTO_GENERATE)
- Add validation middleware (validateBody, validateQuery)
- Document security features in README.md

Closes #329

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

review.bot

2026-03-02 13:04:00 +00:00

added the
component
api

type
feature
labels
requested review from review.bot

review.bot reviewed

2026-03-02 13:04:04 +00:00

review.bot left a comment

Owner

AI Code Review (Devstral)

The PR adds security hardening features including Helmet.js security headers, Zod input validation, configurable CORS origins, and API key auto-generation. The implementation appears correct and addresses the linked issue requirements.

Automated review by pr-reviewer

## AI Code Review (Devstral) The PR adds security hardening features including Helmet.js security headers, Zod input validation, configurable CORS origins, and API key auto-generation. The implementation appears correct and addresses the linked issue requirements. --- *Automated review by [pr-reviewer](https://github.com/customable/pr-reviewer)*

review.bot added

and removed

labels

2026-03-02 13:04:04 +00:00

review.bot merged commit 99824ce9d1 into develop

2026-03-02 13:04:05 +00:00