stwaidele/dorfteich

M24 — VS-NfD: security quick wins

New Issue

Cheap changes with high assessor signal: token key separation, fail-closed CSRF, bounded sessions, restricted backup targets, and the data-hygiene jobs that are missing today (pond purge, orphan files, trash in the search index, audit retention). Includes the residue findings the Ist-Aufnahme added on top of the plan (conversion-job payloads, mail-outbox retention, page-link slugs). No dependencies — can start immediately.

No due date

100% Completed

[VS-NfD] Decide the fate of page_links rows pointing at purged pages

#235 by fable-5 was closed 2026-07-30 23:11:10 +02:00 0 / 3

[VS-NfD] Add retention for mail_outbox

#234 by fable-5 was closed 2026-07-30 23:11:09 +02:00 0 / 4

[VS-NfD] Prune conversion job payloads for every job kind

#233 by fable-5 was closed 2026-07-30 22:35:25 +02:00 0 / 5

[VS-NfD] Verify that no real .env is shipped and document the example as authoritative

area:supply-chain

#198 by fable-5 was closed 2026-07-30 22:00:15 +02:00 0 / 4

[VS-NfD] Add security response headers and an explicitly restrictive CORS policy

#197 by fable-5 was closed 2026-07-30 21:41:54 +02:00 0 / 5

[VS-NfD] Add a retention job for audit_log

#196 by fable-5 was closed 2026-07-30 15:14:28 +02:00 0 / 5

[VS-NfD] Remove trashed content from the search index instead of filtering at query time

#195 by fable-5 was closed 2026-07-30 14:22:50 +02:00 0 / 5

[VS-NfD] Implement the orphan-file sweep and resolve Attachment.deletedAt

#194 by fable-5 was closed 2026-07-30 13:45:58 +02:00 0 / 5

[VS-NfD] Implement pond purge

#193 by fable-5 was closed 2026-07-30 12:59:53 +02:00 0 / 5

[VS-NfD] Restrict backup targets to an allowlist and allow remote targets to be disabled at deploy time

#192 by fable-5 was closed 2026-07-30 12:34:15 +02:00 0 / 4

[VS-NfD] Remove the feed token from the query string, or allow feeds to be disabled

#191 by fable-5 was closed 2026-07-30 11:49:41 +02:00 0 / 4

[VS-NfD] Make the session lifetime configurable and add an idle timeout

#190 by fable-5 was closed 2026-07-30 11:27:28 +02:00 0 / 4

[VS-NfD] Make the CSRF origin check fail closed

#189 by fable-5 was closed 2026-07-30 11:03:58 +02:00 0 / 5

[VS-NfD] Separate token keys with HKDF and replace the homegrown JWT with jose

#188 by fable-5 was closed 2026-07-30 09:05:36 +02:00 0 / 6