M7: Hardening #55

New issue

Closed

opened 2026-07-05 19:21:25 +01:00 by TimCane · 0 comments

TimCane commented

2026-07-05 19:21:25 +01:00

(Migrated from github.com)

Goal

Production readiness: rate limits, upload hardening, security headers, caps, no-PII audit, Puppeteer e2e, prod compose, and a real deploy.

Scope

Rate limit policies, upload sniffing + decode-bomb guard, security headers, caps enforcement, no-PII log audit, Puppeteer e2e specs, prod compose + .env.example, deploy.

References

Acceptance criteria (docs/14)

A1 Both e2e specs green against the full compose stack in CI
A2 Rate limits verified with a scripted burst (429 + Retry-After)
A3 PNG-renamed-to-JPG rejected; 40MB upload rejected with 413
A4 Deployed instance passes the two-phone test over real phones + TLS
A5 One hour after a finalized real session: redis-cli --scan empty, MinIO bucket empty

Notes

Rate limits + upload hardening + headers land before e2e/deploy; prod compose + Dockerfile precede the e2e job and the deploy; ephemerality verification is the final gate.

Sub-tasks are tracked as sub-issues below.

## Goal Production readiness: rate limits, upload hardening, security headers, caps, no-PII audit, Puppeteer e2e, prod compose, and a real deploy. ## Scope Rate limit policies, upload sniffing + decode-bomb guard, security headers, caps enforcement, no-PII log audit, Puppeteer e2e specs, prod compose + .env.example, deploy. ## References - [docs/14-build-order.md#m7---hardening](https://github.com/TimCane/bill-splitter/blob/main/docs/14-build-order.md#m7---hardening) - [docs/10-security-privacy.md](https://github.com/TimCane/bill-splitter/blob/main/docs/10-security-privacy.md) - [docs/12-ci.md](https://github.com/TimCane/bill-splitter/blob/main/docs/12-ci.md) - [docs/13-deployment.md](https://github.com/TimCane/bill-splitter/blob/main/docs/13-deployment.md) - [docs/11-testing-strategy.md](https://github.com/TimCane/bill-splitter/blob/main/docs/11-testing-strategy.md) ## Acceptance criteria (docs/14) - [ ] A1 Both e2e specs green against the full compose stack in CI - [ ] A2 Rate limits verified with a scripted burst (429 + `Retry-After`) - [ ] A3 PNG-renamed-to-JPG rejected; 40MB upload rejected with 413 - [ ] A4 Deployed instance passes the two-phone test over real phones + TLS - [ ] A5 One hour after a finalized real session: `redis-cli --scan` empty, MinIO bucket empty ## Notes Rate limits + upload hardening + headers land before e2e/deploy; prod compose + Dockerfile precede the e2e job and the deploy; ephemerality verification is the final gate. Sub-tasks are tracked as sub-issues below.