Security pass

2026-02-20 12:59:10 +00:00
parent a5a2ffd83e
commit b4d91d5dc0
3 changed files with 14 additions and 3 deletions
@@ -275,6 +275,9 @@ grep -n "r\.\(Get\|Post\|Put\|Delete\|Patch\)" backend/main.go
  - Authenticated users: 120/min
  - Admin search: 60/min
  - Admin-only routes: none (trusted)
+- ⚠️ **Gap: Rate limiter doesn't read CF-Connecting-IP** - behind Cloudflare all users share one bucket
+- ⚠️ **Gap: No HSTS header** - add when HTTPS working
+- ⚠️ **Gap: No Referrer-Policy** - for analytics tracking

 **Input Validation:**
 - Backend validates all inputs against DB schema constraints