Add API key auth, secure CORS defaults, and a Postgres-backed integration suite - #6

Merged

j0shcap merged 6 commits into

mainfrom

security-hardening

Aug 20, 2026

Commits on Aug 20, 2026

Require bearer API key on push and admin endpoints, make clear a DELETE
j0shcap
committed
9cb936c
Disable CORS unless CORS_ORIGINS is configured
j0shcap
committed
0eda74c
Gate SQL echo behind DB_ECHO, share strict boolean env parsing
j0shcap
committed
631ef00
Add integration test suite, CI Postgres service, sandbox e2e script, security docs
j0shcap
committed
b2da589
Replace sandbox script with opt-in pytest e2e suite
j0shcap
committed
b2405b2
Remove APNs sandbox e2e tests
j0shcap
committed
4f1101b