feat: add security hardening and dependency audit

.github/workflows/ci.yml

@@ -38,6 +38,10 @@ jobs:
       - name: Install Dependencies
         run: bun install
 
+      - name: Dependency Audit
+        run: bun audit --audit-level=high
+        continue-on-error: true
+
       - name: Linting
         run: bun run lint
 

docs/ROADMAP.md

@@ -237,22 +237,22 @@ indicator appears and disappears cleanly.
 
 ## Phase 6: Security & Supply-Chain Hardening
 
-- [ ] **Audit CSP in `vercel.json`** — the current CSP has `unsafe-inline` for
+- [x] **Audit CSP in `vercel.json`** — the current CSP has `unsafe-inline` for
       styles and `unsafe-inline` + `unsafe-eval` for scripts. Audit whether
       `unsafe-eval` is actually needed (Astro 7 may not require it). Remove if
       possible; document why if not. Add `upgrade-insecure-requests` if the site
       should be HTTPS-only.
-- [ ] **Add `SECURITY.md`** (if not done in Phase 1) — document the security
+- [x] **Add `SECURITY.md`** (if not done in Phase 1) — document the security
       model: CSP, Supabase RLS, IP hashing, service role key usage, how to report
       vulnerabilities.
-- [ ] **CodeQL + dependency audit** — CodeQL is already in CI. Add
+- [x] **CodeQL + dependency audit** — CodeQL is already in CI. Add
       `bun audit` (or equivalent) to CI to catch known vulnerabilities in
       dependencies. Renovate is already handling automated updates.
-- [ ] **Verify `.env` not in git history** (if not done in Phase 1).
-- [ ] **Add `permissions` to CI workflow** — the `ci.yml` already has
+- [x] **Verify `.env` not in git history** (if not done in Phase 1).
+- [x] **Add `permissions` to CI workflow** — the `ci.yml` already has
       `permissions: contents: read`. Verify `codeql.yml` has minimal permissions
       too.
-- [ ] **Pin GitHub Actions to commit SHAs** — already done (checkout pinned
+- [x] **Pin GitHub Actions to commit SHAs** — already done (checkout pinned
       to `3d3c42e...`, setup-node to `8207627...`, setup-bun to `c05077e...`).
       Verify CodeQL action is also pinned.
 

package.json

@@ -12,7 +12,8 @@
     "prepare": "husky",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "test": "vitest run"
+    "test": "vitest run",
+    "audit": "bun audit"
   },
   "dependencies": {
     "@astrojs/check": "^0.9.9",

vercel.json

@@ -7,7 +7,7 @@
       "headers": [
         {
           "key": "Content-Security-Policy",
-          "value": "default-src 'self'; img-src 'self' https: data:; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https: data:; connect-src 'self' https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self'"
+          "value": "default-src 'self'; img-src 'self' https: data:; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https: data:; connect-src 'self' https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests"
         },
         {
           "key": "X-Frame-Options",