fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -11,6 +11,9 @@ services:
  frontend:
    environment:
      - APP_PUBLIC_BASE_URL=http://localhost:3000
+      # Direct development traffic never supplies trusted forwarding metadata.
+      - INGRESS_MODE=direct
+      - INGRESS_PROXY_CIDRS=
    ports:
      - "3000:80"