Keith SmithandClaude Sonnet 4.5 a06b4365ed Add production security settings for HTTPS/SSL ...

Fixes all 4 Django security warnings:
- ✅ security.W004: Added SECURE_HSTS_SECONDS (1 year HSTS)
- ✅ security.W008: Documented SECURE_SSL_REDIRECT=False (NPM handles SSL)
- ✅ security.W012: Enabled SESSION_COOKIE_SECURE
- ✅ security.W016: Enabled CSRF_COOKIE_SECURE

Additional security hardening:
- HSTS with subdomains and preload
- HttpOnly CSRF cookies
- XSS filter enabled
- Content type sniffing prevention
- Clickjacking protection (X-Frame-Options: DENY)

Note: SECURE_SSL_REDIRECT is intentionally False because Nginx Proxy
Manager handles SSL termination and HTTP→HTTPS redirects at the
reverse proxy level.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2025-12-26 17:33:07 -07:00

..

__init__.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

base.py

Fix HIGH Security Issue: Add file upload validation for avatars

2025-12-23 06:23:11 -07:00

development.py

Add tasks.firebugit.com to development server configuration

2025-12-23 06:08:39 -07:00

production.py

Fix HIGH Security Issue: Require ALLOWED_HOSTS in production

2025-12-23 06:23:34 -07:00

selfhosted.py

Add production security settings for HTTPS/SSL

2025-12-26 17:33:07 -07:00