suculent / thinx-device-api / 545b6ae2-7c2a-4daf-a169-e50a6fd74ef5

73%

master: 14%

push

circleci

docs(21-05): add CSP/CSRF hardening runbook with pre-flip gate

- New .planning/runbooks/csp-csrf-hardening.md: live state, enforce-switch
  choice (CSRF_ENFORCE env recommended over debug.csrf_enforce), pre-flip
  gate from 21-04 (cold login + ~1 day of session/token log watch), flip
  and post-flip verification, HawkScan rescan, and Rollback (env, config,
  service-rollback caveat, gluster CSP restore, middleware revert)
- Refresh rtm.thinx.cloud-server.{pre,post}.nginx from nginx -T in the live
  thinx_vue container; body equals the gluster-mounted console default.conf
  (md5 f4e9fde7) that serves both consoles

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

1696 of 4345 branches covered (39.03%)

Branch coverage included in aggregate %.

3992 of 7586 relevant lines covered (52.62%)

19.2 hits per line