Context

Audit of ZAP DAST scan, OSSF Scorecard, and CodeQL alerts revealed several untracked hardening items. All items below are code-changeable fixes (admin-only settings like rulesets and GitHub security toggles are handled separately).

Acceptance Criteria

Scorecard fixes

• Pin sandbox Dockerfile images by digest — docker/sandbox/Dockerfile uses node:22-slim and python:3.14-slim without @sha256:... digests (backend + web Dockerfiles already pinned)
• Pin wrangler install by npm hash — .github/workflows/pages-preview.yml:236 uses npm i --no-save wrangler@3.114.17 which Scorecard flags as unpinned npmCommand

ZAP DAST fixes

• Return 404 for unmatched routes — exception_handlers.py catches Exception (including Litestar's NotFoundException) and returns 500. Add explicit NotFoundException handler → 404
• Add Cross-Origin-Resource-Policy: same-origin header — missing from app.py response_headers list (other security headers already present)
• Add Cache-Control headers — /health and /openapi.json have no cache directives. Add no-store for health, short max-age for OpenAPI schema
• Suppress ZAP auto-created issues — ZAP action creates issue ZAP API Scan Report #355 on every run; set issue_action: false in workflow to use artifacts only

CodeQL fixes

• Suppress js/log-injection false positives — web/src/stores/websocket.ts:92,100 already use sanitizeForLog() but CodeQL doesn't recognize it. Add CodeQL suppression comments or a custom .github/codeql/ config
• Suppress untrusted-checkout alert — pages-preview.yml:94 already mitigated (no secrets, persist-credentials:false). Add CodeQL inline suppression

Notes

• Items already verified as fixed: API key hashing (HMAC-SHA256), CHANGELOG duplicates, CODEOWNERS, backend/web Dockerfile digest pinning
• Admin-only items (rulesets, GitHub security settings) tracked separately
• Existing related issues: security: replace JWT query parameter with one-time ticket for WebSocket auth #343 (WebSocket JWT), feat: add host/IP allowlisting for git clone URLs (SSRF prevention) #221 (SSRF prevention), fix: resolve OpenAPI schema validation warnings for union/optional fields #268 (OpenAPI warnings)