added security enhancements

backend/src/app.ts

@@ -520,6 +520,7 @@ const oauthProviders = {
   },
 };
 
+app.disable('x-powered-by');
 app.use(helmet({ crossOriginResourcePolicy: false }));
 app.use(
   cors({

docker-compose.prod.yml

@@ -70,6 +70,7 @@ services:
       - traefik.http.routers.flockpal-api.entrypoints=websecure
       - traefik.http.routers.flockpal-api.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}
       - traefik.http.routers.flockpal-api.priority=100
+      - traefik.http.routers.flockpal-api.middlewares=flockpal-hsts@docker
       - traefik.http.services.flockpal-api.loadbalancer.server.port=5000
     networks:
       - default
@@ -92,6 +93,11 @@ services:
       - traefik.http.routers.flockpal-web.entrypoints=websecure
       - traefik.http.routers.flockpal-web.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}
       - traefik.http.routers.flockpal-web.priority=10
+      - traefik.http.routers.flockpal-web.middlewares=flockpal-hsts@docker
+      - traefik.http.middlewares.flockpal-hsts.headers.stsSeconds=31536000
+      - traefik.http.middlewares.flockpal-hsts.headers.stsIncludeSubdomains=true
+      - traefik.http.middlewares.flockpal-hsts.headers.stsPreload=false
+      - traefik.http.middlewares.flockpal-hsts.headers.forceSTSHeader=true
       - traefik.http.services.flockpal-web.loadbalancer.server.port=80
     networks:
       - traefik

frontend/nginx.conf

@@ -1,10 +1,17 @@
 server {
   listen 80;
   server_name _;
+  server_tokens off;
 
   root /usr/share/nginx/html;
   index index.html;
 
+  add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'" always;
+  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+  add_header X-Content-Type-Options "nosniff" always;
+  add_header X-Frame-Options "SAMEORIGIN" always;
+  add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
   location / {
     try_files $uri $uri/ /index.html;
   }

frontend/public/robots.txt

@@ -0,0 +1,33 @@
+# FlockPal robots.txt
+# Allows normal search indexing while reserving rights against AI training and AI answer ingestion.
+
+User-agent: *
+Content-Signal: search=yes,ai-input=no,ai-train=no
+Allow: /
+
+User-agent: Amazonbot
+Disallow: /
+
+User-agent: Applebot-Extended
+Disallow: /
+
+User-agent: Bytespider
+Disallow: /
+
+User-agent: CCBot
+Disallow: /
+
+User-agent: ClaudeBot
+Disallow: /
+
+User-agent: CloudflareBrowserRenderingCrawler
+Disallow: /
+
+User-agent: Google-Extended
+Disallow: /
+
+User-agent: GPTBot
+Disallow: /
+
+User-agent: meta-externalagent
+Disallow: /