CarterPerez-dev 4382ba5e17 fix(canary): CSP allows challenges.cloudflare.com for Turnstile ... Audit F10: script-src 'self' blocked the Turnstile bootstrap script (https://challenges.cloudflare.com/turnstile/v0/api.js) and its widget iframe. Added challenges.cloudflare.com to script-src, connect-src, and a new frame-src directive so the widget can render under prod CSP.		2026-05-17 19:07:41 -04:00
..
backend	fix(canary): CSP allows challenges.cloudflare.com for Turnstile	2026-05-17 19:07:41 -04:00
frontend	fix(canary): accept null events from manage response	2026-05-17 17:58:13 -04:00
infra	fix(canary): declare VITE_TURNSTILE_SITE_KEY ARG in prod Dockerfile	2026-05-17 19:07:39 -04:00
scripts	fix(canary-phase1): clear all post-phase-1 audit observations + header normalization	2026-05-10 06:15:26 -04:00
.env.example	fix(canary-phase0): address audit findings before phase rollup	2026-05-10 05:37:32 -04:00
.gitignore	chore(canary): expand project .gitignore for Go + Node + secrets	2026-05-10 05:13:19 -04:00
cloudflared.compose.yml	fix(canary-phase0): address audit findings before phase rollup	2026-05-10 05:37:32 -04:00
compose.yml	fix(canary-phase1): clear all post-phase-1 audit observations + header normalization	2026-05-10 06:15:26 -04:00
dev.compose.yml	fix(canary): vite dev proxy — correct backend port + stop stripping /api	2026-05-17 17:37:36 -04:00
justfile	feat(canary): unified Justfile with frontend + backend + compose groups	2026-05-10 05:25:27 -04:00