Valid finding from PR review: copy button's JS string could break
on values with newlines. Added \n and \r escaping.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Defense-in-depth headers added via tower-http SetResponseHeaderLayer:
- Strict-Transport-Security: max-age=31536000; includeSubDomains
- X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin
Primary enforcement should still be at the Traefik/reverse proxy level.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bug fixes:
1. CVE notifications now created during scan pipeline (not just hourly)
- Previously, notifications were only created by the scheduled
monitor_cves job. Users with 4 CVE alerts saw 0 notifications.
- Now the scan pipeline (Stage 3) creates notifications immediately
when CVE alerts are discovered, with the same dedup logic.
2. Help chat doc context loading fixed for Docker/production
- Added HELP_DOCS_PATH env var for explicit doc root configuration
- Added fallback chain: env var → binary location → cwd → Docker paths
- Dockerfile.agent now copies README.md and docs/ into /app and sets
HELP_DOCS_PATH=/app so the help chat has doc context in production
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
