MechaCat02 90f2398e56 fix: send HSTS on HTTPS document responses ...

Add Strict-Transport-Security (max-age=63072000; includeSubDomains) in
applySecurityHeaders, gated on x-forwarded-proto === 'https' so a plain-HTTP
dev/misconfig deploy never pins the browser to HTTPS (audit LOW). Tested.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-13 21:52:54 +02:00

..

migrations

fix: batch and index the crawler_jobs retention reaper

2026-07-13 21:46:01 +02:00

src

fix: enable browser SSRF interception by default (H1)

2026-07-13 21:51:05 +02:00

tests

fix: fall back to the original when a thumbnail fails to decode

2026-07-13 21:41:28 +02:00

.dockerignore

bugfix: third-pass audit follow-ups (F1-F4 + dockerignore)

2026-05-17 00:13:14 +02:00

.gitignore

feat(analysis): add ocrs OCR backend and OCR-driven page text search

2026-06-30 19:52:43 +02:00

Cargo.lock

fix: send HSTS on HTTPS document responses

2026-07-13 21:52:54 +02:00

Cargo.toml

fix: send HSTS on HTTPS document responses

2026-07-13 21:52:54 +02:00

Dockerfile

feat(analysis): add ocrs OCR backend and OCR-driven page text search

2026-06-30 19:52:43 +02:00