Jason Woltje 617df12b52 fix(SEC-API-25+26): Enable strict ValidationPipe + tighten CORS origin ...

- Set forbidNonWhitelisted: true in ValidationPipe to reject requests
  with unknown DTO properties, preventing mass assignment vulnerabilities
- Reject requests with no Origin header in production (SEC-API-26)
- Restrict localhost:3001 to development mode only
- Update CORS tests to cover production/development origin validation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-06 15:02:55 -06:00

..

api

fix(SEC-API-25+26): Enable strict ValidationPipe + tighten CORS origin

2026-02-06 15:02:55 -06:00

coordinator

fix(#338): Sanitize issue body for prompt injection

2026-02-05 18:36:16 -06:00

orchestrator

fix(SEC-REVIEW-4-7): Address remaining MEDIUM security review findings

2026-02-06 14:51:22 -06:00

web

fix(SEC-REVIEW-1): Surface search errors in LinkAutocomplete

2026-02-06 14:42:47 -06:00