CarterPerez-dev 4382ba5e17 fix(canary): CSP allows challenges.cloudflare.com for Turnstile ... Audit F10: script-src 'self' blocked the Turnstile bootstrap script (https://challenges.cloudflare.com/turnstile/v0/api.js) and its widget iframe. Added challenges.cloudflare.com to script-src, connect-src, and a new frame-src directive so the widget can render under prod CSP.		2026-05-17 19:07:41 -04:00
..
fingerprint.go	feat(canary): middleware additions (realip, fingerprint, recovery)	2026-05-13 15:04:29 -04:00
fingerprint_test.go	feat(canary): middleware additions (realip, fingerprint, recovery)	2026-05-13 15:04:29 -04:00
headers.go	fix(canary): CSP allows challenges.cloudflare.com for Turnstile	2026-05-17 19:07:41 -04:00
logging.go	fix(canary-phase1): clear all post-phase-1 audit observations + header normalization	2026-05-10 06:15:26 -04:00
operator_bearer.go	feat(canary): OperatorBearer middleware + operator token config	2026-05-14 06:57:10 -04:00
operator_bearer_test.go	feat(canary): OperatorBearer middleware + operator token config	2026-05-14 06:57:10 -04:00
ratelimit.go	fix(canary): replace //nolint pragmas with explicit error handling	2026-05-13 13:28:44 -04:00
realip.go	feat(canary): middleware additions (realip, fingerprint, recovery)	2026-05-13 15:04:29 -04:00
recovery.go	feat(canary): middleware additions (realip, fingerprint, recovery)	2026-05-13 15:04:29 -04:00
recovery_test.go	feat(canary): middleware additions (realip, fingerprint, recovery)	2026-05-13 15:04:29 -04:00
request_id.go	fix(canary-phase1): clear all post-phase-1 audit observations + header normalization	2026-05-10 06:15:26 -04:00
turnstile.go	feat(canary): turnstile verifier + middleware	2026-05-13 15:08:37 -04:00
turnstile_test.go	feat(canary): turnstile verifier + middleware	2026-05-13 15:08:37 -04:00