Phase 9 adds the first production hardening layer.

• API security headers:
  • X-Content-Type-Options
  • X-Frame-Options
  • Referrer-Policy
  • Permissions-Policy
  • Content-Security-Policy
  • Strict-Transport-Security when served through HTTPS
• Dashboard nginx security headers.
• Login rate limiting by remote address and email.
• Request body limits on auth JSON endpoints.
• Production guard that rejects the default development auth secret when APP_ENV=production.
• Gateway public HTTP server timeouts and max header size.
• Existing hashed token storage and one-time token display.

Use a long random value:

AUTH_ACCESS_TOKEN_SECRET="$(openssl rand -base64 48)"
APP_ENV=production

Run the public gateway behind TLS. For Kubernetes, use cert-manager with the Helm ingress values.

• Redis-backed distributed rate limits.
• Cookie auth mode with CSRF protection if browser cookies are chosen.
• mTLS for agent transport.
• Signed release checksums for agent binaries.