will.anderson
8d741fac20
- Turnstile server-side verification: reject requests with no cf_token; read secret from TURNSTILE_SECRET_KEY env (no longer hardcoded); fix siteverify URL from v0 to v1 - Security headers: wrap all responses via http_response() with HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy - GCS error info leak: guard /share/<id> response — only return content that starts with '<' (valid HTML); GCS error JSON is silently 404d - robots.txt: remove Sitemap reference to sitemap.xml that returns 404 - SRI hash: add integrity + crossorigin attributes to marked.min.js CDN tag - Attestations bucket: write /api/attest records to GCS_ATTEST_BUCKET (dedicated private bucket) instead of the share bucket; falls back to GCS_SHARE_BUCKET if GCS_ATTEST_BUCKET is not set (legacy deploys)