Graham McIntie 9ecd01dc8f Security hardening: remaining audit fixes ... - Encrypt session cookies (add encryption_salt to endpoint) - X-Frame-Options: SAMEORIGIN → DENY (match CSP frame-ancestors 'none') - Remove unsafe-eval from CSP script-src - Apply security headers in all environments (not just prod) - Add GraphQL query complexity limit (max 500) via Absinthe.Plug - GraphQL introspection already blocked in prod via plug Closes audit items #6, #7, #12, #13, #14, #16		2026-02-15 12:54:38 -06:00
..
api_auth_test.exs	Add comprehensive tests for API authentication and authorization	2026-02-05 16:39:01 -06:00
brute_force_protection_test.exs	fix: prevent AlreadySentError in BruteForceProtection plug	2026-02-12 12:53:32 -06:00
capture_timezone_test.exs	Remove misleading duplicate header test from CaptureTimezone	2026-02-01 11:08:12 -06:00
check_policy_consent_test.exs	fix user session controller test	2026-02-03 13:42:24 -06:00
detect_eu_user_test.exs	snmp v3 support	2026-02-04 12:02:38 -06:00
mobile_auth_test.exs	Fix tests, credo issues, and Gaiia sync bugs	2026-02-15 11:55:49 -06:00
rate_limit_test.exs	docs: add gettext internationalization design	2026-02-02 09:33:01 -06:00
remote_ip_logger_test.exs	more tests	2026-02-03 13:20:33 -06:00
security_headers_test.exs	Security hardening: remaining audit fixes	2026-02-15 12:54:38 -06:00
update_session_activity_test.exs	fix 5 failing tests	2026-02-11 12:21:06 -06:00
webhook_auth_test.exs	Add CI-triggered mass agent update webhook	2026-02-10 13:40:32 -06:00