Graham McIntie 9ecd01dc8f Security hardening: remaining audit fixes ... - Encrypt session cookies (add encryption_salt to endpoint) - X-Frame-Options: SAMEORIGIN → DENY (match CSP frame-ancestors 'none') - Remove unsafe-eval from CSP script-src - Apply security headers in all environments (not just prod) - Add GraphQL query complexity limit (max 500) via Absinthe.Plug - GraphQL introspection already blocked in prod via plug Closes audit items #6, #7, #12, #13, #14, #16		2026-02-15 12:54:38 -06:00
..
api_auth.ex	refactor: use API token auth for profile imports instead of session cookies	2026-01-18 09:30:21 -06:00
brute_force_protection.ex	fix: prevent AlreadySentError in BruteForceProtection plug	2026-02-12 12:53:32 -06:00
capture_timezone.ex	Use detected timezone from session in user registration	2026-02-01 12:18:33 -06:00
check_policy_consent.ex	gdpr consent tracking	2026-01-29 11:12:35 -06:00
detect_eu_user.ex	snmp v3 support	2026-02-04 12:02:38 -06:00
graphql_introspection.ex	Security fixes: mask credentials in logs/API, fix cookie/CSP/LIKE injection/webhooks	2026-02-15 09:09:04 -06:00
mobile_auth.ex	Add comprehensive Dialyzer type specifications	2026-01-17 10:52:02 -06:00
rate_limit.ex	update hammer	2026-02-08 10:08:31 -06:00
remote_ip_logger.ex	nif ci fixes and dialyzer fixes	2026-01-30 12:38:50 -06:00
security_headers.ex	Security hardening: remaining audit fixes	2026-02-15 12:54:38 -06:00
update_session_activity.ex	fix: netbox url field type, gaiia ipRange→block, remove unknown webhook log	2026-02-14 17:44:01 -06:00
webhook_auth.ex	Add CI-triggered mass agent update webhook	2026-02-10 13:40:32 -06:00