fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
2b39ae8c0a39595ec8b02714a0801f5ada679037
agentic-dev/docs/work/archive/epics/security-headers-rate-limit-sbom/_epic.md
Danijel Martinek 2b39ae8c0a docs(work): archive shipped template epics and PRDs 
Move the 8 shipped template epics and their 9 PRDs (incl.
coverage-architecture) to docs/work/archive/{epics,prds}/ so dispatch
context and prioritization only see live Veect work. The state builder
already walks docs/work/epics/ + docs/work/prds/ only; the one work-CLI
script that matched archive paths (bump-updated-timestamps.mjs, staged
docs/work/**/*.md) now excludes docs/work/archive/ so archived content
stays byte-identical.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
2026-07-12 17:32:20 +02:00

2.2 KiB
Raw Blame History

id, prd, title, type, status, features, created, updated
id prd title type status features created updated
security-headers-rate-limit-sbom docs/work/prds/security-headers-rate-limit-sbom.prd.md Security headers + rate-limit primitive + SBOM in CI — Epic C of ADR-025 epic done
core-shared
core-testing
core-eslint
auth
web-next
web-tanstack
cms
2026-05-20T00:00:00Z 2026-05-20T11:49:44.873Z

Goal

Ship three hardening primitives — framework-agnostic security header middleware, a manifest-declared rate-limit conformance channel, and per-release SBOM evidence — so downstream consumers get compliant default headers, lint-enforced rate-limit gates, and CycloneDX audit artifacts without inventing any of them.

Why

Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and CSP on every template app response. Auth endpoints (signIn, signUp) ship without rate-limit declarations, leaving credential-stuffing windows open until a consumer notices their auth logs. Consumers pursuing SOC 2 / ISO 27001 / FedRAMP must invent SBOM tooling and bolt it into their release flow. ADR-025 settled the strategy; this epic is the implementation.

Stories