feat: add Helmet security headers and restrict CORS to known origin#116

Merged

GitAddRemote merged 8 commits intomainfrom

fix/ISSUE-94-helmet-cors

Apr 13, 2026

Commits on Apr 12, 2026

feat: add Helmet security headers and restrict CORS to known origin
GitAddRemote
committed
chore: update pnpm-lock.yaml to match package.json
GitAddRemote
committed

Commits on Apr 13, 2026

fix: address review comments on Helmet CSP and CORS config
GitAddRemote
committed
fix: tighten CSP in production and fail fast on missing ALLOWED_ORIGIN
GitAddRemote
committed
fix: consolidate NODE_ENV access via ConfigService and harden Helmet
GitAddRemote
committed
fix: validate NODE_ENV at startup to prevent misconfigured security posture
GitAddRemote
committed
docs: add NODE_ENV to .env.example with allowed values noted
GitAddRemote
committed
fix: move NODE_ENV comment to its own line in .env.example
GitAddRemote
committed