CarterPerez-dev 4382ba5e17 fix(canary): CSP allows challenges.cloudflare.com for Turnstile ... Audit F10: script-src 'self' blocked the Turnstile bootstrap script (https://challenges.cloudflare.com/turnstile/v0/api.js) and its widget iframe. Added challenges.cloudflare.com to script-src, connect-src, and a new frame-src directive so the widget can render under prod CSP.		2026-05-17 19:07:41 -04:00
..
cmd	feat(canary): wire geoip into main with NopService fallback	2026-05-17 05:24:29 -04:00
internal	fix(canary): CSP allows challenges.cloudflare.com for Turnstile	2026-05-17 19:07:41 -04:00
.air.toml	fix(canary-phase1): clear all post-phase-1 audit observations + header normalization	2026-05-10 06:15:26 -04:00
.gitignore	fix(canary-phase0): address audit findings before phase rollup	2026-05-10 05:37:32 -04:00
.golangci.yml	chore(canary): scope gosec G101/G107/G704 to outbound HTTP packages	2026-05-14 00:32:07 -04:00
config.yaml	fix(canary-phase1): clear all post-phase-1 audit observations + header normalization	2026-05-10 06:15:26 -04:00
go.mod	feat(canary): geoip wrapper package + config wiring	2026-05-17 05:23:53 -04:00
go.sum	feat(canary): geoip wrapper package + config wiring	2026-05-17 05:23:53 -04:00