fix(security): helmet, request size limit, login rate limiting#44

Merged

dimakis merged 12 commits intomainfrom

fix/security-quick-wins

Apr 3, 2026

Commits on Apr 3, 2026

docs(design): add Phase A test harness design doc
dimakis
committed
build(test): add test infrastructure dependencies and vitest workspace
dimakis
committed
refactor(server): extract app.ts from index.ts for testability
dimakis
committed
test(server): add route-layer tests for all HTTP endpoints
dimakis
committed
test(frontend): add component and hook tests with jsdom environment
dimakis
committed
build(ci): add npm audit, mcp-server build, raise test count to 250
dimakis
committed
build(ci): update to Node 24 to match development environment
dimakis
committed
fix(ci): use npm install instead of npm ci for cross-platform deps
dimakis
committed
fix: resolve TS error in routes test set-cookie type cast
dimakis
committed
fix(security): add helmet, request size limit, and login rate limiting
dimakis
committed
fix(security): add img-src data: to CSP, add security regression tests
dimakis
committed
Merge branch 'main' into fix/security-quick-wins
dimakis
committed