Security: Add HTTPS redirect and HSTS header (TRN01/TRN04) #43
Labels
No labels
bug
deferred
documentation
enhancement
feature
infra
integration
marketing
priority:high
priority:low
priority:medium
Pro
security
UX
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
frank/cookslate#43
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
No HTTPS redirect in .htaccess or PHP. No HSTS header configured. Caddy handles TLS in prod but the app doesn't enforce it.\n\nFix: Add HSTS header in Caddy config or .htaccess. Ensure HTTP->HTTPS redirect.\n\nSecurity audit: TRN01 (critical), TRN04 (medium)