fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
main
agentic-dev/docs/work/epics/security-headers-rate-limit-sbom/_epic.md

2.2 KiB
Raw Permalink Blame History

id, prd, title, type, status, features, created, updated
id prd title type status features created updated
security-headers-rate-limit-sbom docs/work/prds/security-headers-rate-limit-sbom.prd.md Security headers + rate-limit primitive + SBOM in CI — Epic C of ADR-025 epic done
core-shared
core-testing
core-eslint
auth
web-next
web-tanstack
cms
2026-05-20T00:00:00Z 2026-05-20T11:49:44.873Z

Goal

Ship three hardening primitives — framework-agnostic security header middleware, a manifest-declared rate-limit conformance channel, and per-release SBOM evidence — so downstream consumers get compliant default headers, lint-enforced rate-limit gates, and CycloneDX audit artifacts without inventing any of them.

Why

Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and CSP on every template app response. Auth endpoints (signIn, signUp) ship without rate-limit declarations, leaving credential-stuffing windows open until a consumer notices their auth logs. Consumers pursuing SOC 2 / ISO 27001 / FedRAMP must invent SBOM tooling and bolt it into their release flow. ADR-025 settled the strategy; this epic is the implementation.

Stories