Files

T

Abiba 9a633583ab fix: Security hardening from CT116 deep-dive review

- API keys moved from hardcoded dict to env var (API_KEYS JSON) with fallback
- Rate limiting added: token bucket per API key (Redis-backed), 429 responses with Retry-After
- Rate limit tiers: enterprise 120/min, professional 60/min, starter 20/min
- X-RateLimit-* headers on all responses
- Dashboard polling reduced from 3s to 5s backend, 10s JS fallback
- SSE detection disables redundant polling when stream is connected
- Deleted ts_patch.py (dead one-shot migration, already applied)
- Added ssl/README.md documenting upstream SSL termination

Ref: Relay #444 (Mumuni CT116 harness deep-dive)
Reviewed-by: Abiba <abiba@sysloggh.com>

2026-06-02 10:37:10 +00:00

README.md

fix: Security hardening from CT116 deep-dive review

2026-06-02 10:37:10 +00:00

README.md

SSL Directory

SSL termination is handled upstream by NetBird/Authentik. This directory is intentionally empty — no certs stored here.

For local dev SSL, use the docker-compose.override.yml pattern.