security audit v5: project-proxy hardening & middleware consolidation#424

Merged

mohanadft merged 3 commits intomainfrom

security-audit-v5

Apr 14, 2026

Commits on Apr 14, 2026

fix(security): normalise path before prefix check in project-proxy to prevent dot-segment traversal
mohanadft
committed
fix(security): merge dead cache-control middleware into active CSP middleware via sequence()
mohanadft
committed
fix(security): replace header passthrough with explicit allowlist in project-proxy
mohanadft
committed