[E24-S03-T01] CSP/security headers #351

New Issue

2026-08-27T08:08:48Z

kpcto commented

2026-08-27 08:08:48 +00:00

Parent story: [E24-S03] CSP/security headers (#149)

Intent

Verify CSP and security headers on actual HTTP responses.

Acceptance criteria

CSP and security headers are verified on actual responses, not only plugin registration.
Headers apply to public and admin responses where required.

Explicitly out of scope

Threat model (E24-S01), rate limits (E24-S02), and dependency response process (E24-S04).

Test plan

Automated test asserting actual header values on served responses.

Rollback note

Configuration only; reverting header config restores prior behaviour.

Owning stream

platform

Risk quadrant

agent-full

> Parent story: [E24-S03] CSP/security headers (#149) ## Intent Verify CSP and security headers on actual HTTP responses. ## Acceptance criteria - CSP and security headers are verified on actual responses, not only plugin registration. - Headers apply to public and admin responses where required. ## Explicitly out of scope - Threat model (E24-S01), rate limits (E24-S02), and dependency response process (E24-S04). ## Test plan - Automated test asserting actual header values on served responses. ## Rollback note - Configuration only; reverting header config restores prior behaviour. ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint 7 milestone 2026-08-27 08:08:48 +00:00

kpcto added the

labels 2026-08-27 08:08:48 +00:00

Sign in to join this conversation.