Ho Ngoc Hai 017d85247e fix(security): harden security headers across API and Web apps ...

- API: set X-Frame-Options to DENY via frameguard, add Permissions-Policy header, widen CSP connect-src for Swagger CDN
- Web: add HSTS header (1yr, includeSubDomains, preload), add payment=(self) to Permissions-Policy, make localhost:3001 in CSP connect-src dev-only

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-04-10 20:10:22 +07:00

..

workflows

fix(security): harden security headers across API and Web apps

2026-04-10 20:10:22 +07:00

dependabot.yml

docs: add comprehensive K6 load testing guide with API structure

2026-04-09 01:34:15 +07:00