fix(api): address ZAP DAST scan findings by Aureliolo · Pull Request #579 · Aureliolo/synthorg

Aureliolo · 2026-03-19T10:37:46Z

Summary

Add ZAP rules file (.github/zap-rules.tsv) suppressing 4 validated false positives (unexpected content-type on /docs HTML, client error responses from literal path params, base64 patterns in public OpenAPI schema, Sec-Fetch-* headers with JWT auth) and keeping Non-Storable Content as WARN
Make Cache-Control path-aware in security headers middleware: /docs/* gets public, max-age=300 (public, unauthenticated content), API endpoints keep no-store
Wire _API_CACHE_CONTROL constant into _SECURITY_HEADERS dict to prevent silent divergence
Fix pre-existing bare string event "asgi_missing_status" to use API_ASGI_MISSING_STATUS constant
Update DAST workflow to reference rules file, update docs/security.md with DAST Tuning section, update CLAUDE.md CI description

Test plan

New TestCacheControlPathSelection class (7 parametrized + 1 cross-header assertion)
Boundary path tests (/documents, /docsearch get no-store; /docs, /docs/api, /docs/openapi.json get cached)
Combined COOP + Cache-Control assertion (both apply on /docs paths)
All 9547 tests pass, 94% coverage
mypy strict clean, ruff clean
All pre-commit and pre-push hooks pass
ZAP rules file verified with cat -A for tab characters

Review coverage

Pre-reviewed by 11 agents (docs-consistency, code-reviewer, python-reviewer, pr-test-analyzer, conventions-enforcer, logging-audit, resilience-audit, security-reviewer, infra-reviewer, test-quality-reviewer, issue-resolution-verifier). 5 findings addressed.

Closes #441

🤖 Generated with Claude Code

…ware Cache-Control Add ZAP rules file (.github/zap-rules.tsv) to suppress validated false positives: unexpected content-type on /docs HTML endpoints, client error responses from literal path params, base64 patterns in public OpenAPI schema, and Sec-Fetch-* headers (JWT auth, no CSRF risk). Non-Storable Content kept as WARN for visibility. Make Cache-Control path-aware: /docs/* gets public, max-age=300 (public, unauthenticated content safe for brief caching), API endpoints keep no-store (sensitive dynamic data). Wire _API_CACHE_CONTROL constant into _SECURITY_HEADERS to prevent silent divergence. Fix pre-existing bare string event "asgi_missing_status" in middleware to use API_ASGI_MISSING_STATUS constant from observability events. Closes #441 Pre-reviewed by 11 agents, 5 findings addressed Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-19T10:37:57Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

coderabbitai · 2026-03-19T10:38:07Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 62d04fe4-69eb-4000-8386-1fedadcc1c00

📥 Commits

Reviewing files that changed from the base of the PR and between 7f4cc0b and a46bbcd.

📒 Files selected for processing (2)

CLAUDE.md
docs/security.md

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Build Backend

🧰 Additional context used

🧠 Learnings (5)

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Applies to .github/workflows/docker.yml : CI Docker: build → scan → push to GHCR + cosign sign + SLSA L3 provenance via attest-build-provenance (images only pushed after Trivy/Grype scans pass).

Applied to files:

CLAUDE.md
docs/security.md

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Pre-commit hooks: trailing-whitespace, end-of-file-fixer, check-yaml, check-toml, check-json, check-merge-conflict, check-added-large-files, no-commit-to-branch (main), ruff check+format, gitleaks, hadolint (Dockerfile linting).

Applied to files:

CLAUDE.md
docs/security.md

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Applies to .github/workflows/**/*.yml : Path filtering: dorny/paths-filter detects Python/dashboard/docker changes; jobs only run when their domain is affected. CLI has its own workflow (cli.yml).

Applied to files:

CLAUDE.md

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Pre-push hooks: mypy type-check + pytest unit tests + golangci-lint + go vet + go test (CLI, conditional on cli/**/*.go) (fast gate before push, skipped in pre-commit.ci — dedicated CI jobs already run these).

Applied to files:

CLAUDE.md
docs/security.md

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Commits: <type>: <description> — types: feat, fix, refactor, docs, test, chore, perf, ci. Enforced by commitizen (commit-msg hook). Signed commits: required on main via branch protection — all commits must be GPG/SSH signed.

Applied to files:

CLAUDE.md
docs/security.md

🪛 LanguageTool

CLAUDE.md

[uncategorized] ~285-~285: The official name of this software platform is spelled with a capital “H”.
Context: ...ia publish_results: true. - DAST: .github/workflows/dast.yml -- ZAP API scan aga...

(GITHUB)

[uncategorized] ~285-~285: The official name of this software platform is spelled with a capital “H”.
Context: ...starts container, runs ZAP. Rules file (.github/zap-rules.tsv) suppresses validated fa...

(GITHUB)

docs/security.md

[uncategorized] ~224-~224: The official name of this software platform is spelled with a capital “H”.
Context: ...he ZAP API scan runs with a rules file (.github/zap-rules.tsv) that suppresses validat...

(GITHUB)

🔇 Additional comments (4)

docs/security.md (3)

90-91: Good path-aware header documentation update.

This clearly documents the API/docs split for COOP and cache directives, matching the intended hardening behavior.

216-216: DAST schedule update is clear and actionable.

The scan cadence is now explicitly aligned with push-to-main and weekly execution.

222-239: Strong DAST tuning section with concrete rationale.

The rule table and cache-behavior explanation make future triage and scan maintenance much easier.

CLAUDE.md (1)

285-285: CI documentation update is accurate and well-scoped.

The added DAST note cleanly captures rules-file usage and current artifact/SARIF limitations.

Based on learnings: Applies to .github/workflows/**/*.yml path filtering and CI workflow behavior context documented in CLAUDE.md.

📝 Walkthrough

Summary by CodeRabbit

New Features
- Path-aware security headers: stricter caching for API responses; relaxed caching and COOP for docs routes.
Documentation
- Updated security and CI docs to describe cache/COOP behavior and a DAST tuning rules file that suppresses validated false positives.
Tests
- Added/updated tests validating header selection and docs-specific header relaxations.

Walkthrough

Adds ZAP DAST tuning via .github/zap-rules.tsv, makes Cache-Control path-aware (API: no-store, docs: public, max-age=300), adjusts Cross-Origin-Opener-Policy for docs, replaces a literal ASGI missing-status string with an exported event constant, and updates tests and docs accordingly.

Changes

Cohort / File(s)	Summary
DAST workflow & CI docs `.github/workflows/dast.yml`, `CLAUDE.md`	Passes `rules_file_name: .github/zap-rules.tsv` to the ZAP action; docs updated to state the rules file suppresses validated false positives and reference `docs/security.md` DAST tuning.
Security documentation `docs/security.md`	Made `Cache-Control` path-aware, split COOP for API vs docs, changed DAST schedule to "on push to main + weekly", and added a "DAST Tuning" section describing `.github/zap-rules.tsv` handling of expected false positives and specific warnings.
Middleware header logic `src/synthorg/api/middleware.py`	Introduced `_API_CACHE_CONTROL` and `_DOCS_CACHE_CONTROL`; replaced hardcoded `Cache-Control` with constants and override for `/docs*`; set docs COOP to `same-origin-allow-popups`; replaced literal `"asgi_missing_status"` with exported event constant.
Observability events `src/synthorg/observability/events/api.py`	Added exported constant `API_ASGI_MISSING_STATUS = "api.asgi.missing_status"`.
Middleware tests `tests/unit/api/test_middleware.py`	Consolidated path-specific CSP assertions into a parametrized test; added tests for Cache-Control path selection and docs-specific combined header expectations (cache-control + COOP).

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

ci: add pip-audit, hadolint, OSSF Scorecard, ZAP DAST, and pre-push hooks #350: Earlier DAST workflow addition — this PR augments that workflow by supplying a ZAP rules file and related docs.
fix: ensure security headers on all HTTP responses #437: Prior changes to the security_headers_hook — this PR further adjusts path-aware headers and COOP behavior.
fix(api): resolve WebSocket 403 rejection (#549) #556: Adds API observability event constants in the same src/synthorg/observability/events/api.py module.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title concisely describes the main objective of the PR: addressing ZAP DAST scan findings through security header fixes, cache control path awareness, and a ZAP rules file configuration.
Description check	✅ Passed	The description provides comprehensive details about the changes including the ZAP rules file, cache-control path awareness, constant usage, event identifier replacement, and documentation updates.
Linked Issues check	✅ Passed	The PR successfully addresses all key objectives from issue `#441`: suppresses false positives via ZAP rules file, implements path-aware Cache-Control headers, replaces bare event strings with constants, and updates documentation.
Out of Scope Changes check	✅ Passed	All changes are directly related to the ZAP DAST scan findings and security improvements. Minor documentation updates to CLAUDE.md and broader security header tuning are justified by the scope of addressing DAST findings.
Docstring Coverage	✅ Passed	Docstring coverage is 88.89% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/zap-scan-findings

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/zap-scan-findings

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2026-03-19T10:38:11Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the API's security posture and performance by refining its Dynamic Application Security Testing (DAST) process and optimizing HTTP caching. It addresses false positives in security scans, ensuring more accurate reporting, and intelligently manages Cache-Control headers to improve the delivery of public documentation while maintaining strict security for API data.

Highlights

ZAP DAST Tuning: Introduced a new ZAP rules file (.github/zap-rules.tsv) to suppress four validated false positives (unexpected content-type, client error responses, base64 disclosure, missing Sec-Fetch-* headers) and set Non-Storable Content to WARN, improving DAST scan accuracy.
Path-Aware Cache-Control: Implemented dynamic Cache-Control headers in the security middleware, applying public, max-age=300 for public documentation paths (/docs/*) to enable caching, while maintaining no-store for API endpoints to prevent sensitive data caching.
Constant Wiring for Cache-Control: Ensured consistency by wiring the _API_CACHE_CONTROL constant into the _SECURITY_HEADERS dictionary, preventing silent divergence in cache control settings.
Event Constant Fix: Corrected a pre-existing bare string event "asgi_missing_status" to use the newly defined API_ASGI_MISSING_STATUS constant, improving event logging consistency.
Documentation and Workflow Updates: Updated the DAST workflow to reference the new rules file, added a "DAST Tuning" section to docs/security.md explaining the rule suppressions, and updated CLAUDE.md to reflect these DAST changes.

Ignored Files

Ignored by pattern: .github/workflows/** (1)
- .github/workflows/dast.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request addresses ZAP DAST scan findings by introducing a rules file to suppress validated false positives and by implementing path-aware Cache-Control headers. The changes are well-implemented, with clear constants, updated documentation, and comprehensive tests. The logic for differentiating API and documentation paths for caching policies is correct. The use of constants for event names and cache control values improves maintainability. I have reviewed the changes and have no further recommendations.

- Add COOP row to security headers table in docs/security.md - Fix DAST schedule text (was "Weekly + on-demand", now "On push to main + weekly") - Reorder Cache-Control constants: default (_API) before override (_DOCS), matching CSP pair - Add Cache-Control to module-level docstring in middleware.py - Tighten COOP from unsafe-none to same-origin-allow-popups on /docs paths (prevents XS-Leak via window.opener while still allowing Scalar UI popups) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

codecov · 2026-03-19T10:52:22Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.66%. Comparing base (a1bedb8) to head (a46bbcd).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #579   +/-   ##
=======================================
  Coverage   92.66%   92.66%           
=======================================
  Files         545      545           
  Lines       27061    27065    +4     
  Branches     2603     2603           
=======================================
+ Hits        25076    25080    +4     
  Misses       1568     1568           
  Partials      417      417

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/unit/api/test_middleware.py`:
- Around line 227-236: Rename the test function
test_docs_cache_does_not_suppress_coop_relaxation to a positive, clearer name
like test_docs_path_applies_cache_and_coop_relaxations; update any
references/imports if present so the test runner picks it up, leaving the body
unchanged (requests to "/docs/openapi.json", assertions against headers
"cache-control" == _DOCS_CACHE_CONTROL and "cross-origin-opener-policy" ==
"same-origin-allow-popups" should remain as-is) to preserve the original
assertions and intent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ea7e8efb-3590-4edb-980e-81d69ae5a200

📥 Commits

Reviewing files that changed from the base of the PR and between 9b0d34d and b42d7b8.

📒 Files selected for processing (3)

docs/security.md
src/synthorg/api/middleware.py
tests/unit/api/test_middleware.py

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)

GitHub Check: Build Backend
GitHub Check: Build Web
GitHub Check: Build Sandbox
GitHub Check: Test (Python 3.14)
GitHub Check: Analyze (python)

🧰 Additional context used

📓 Path-based instructions (4)

docs/**/*.md

📄 CodeRabbit inference engine (CLAUDE.md)

Always read the relevant docs/design/ page before implementing any feature or planning any issue. The design spec is the starting point for architecture, data models, and behavior.

Files:

docs/security.md

**/*.py

📄 CodeRabbit inference engine (CLAUDE.md)

**/*.py: Use from synthorg.observability import get_logger followed by logger = get_logger(__name__) in every module with business logic. Never use import logging, logging.getLogger(), or print() in application code.
Use event name constants from domain-specific modules under synthorg.observability.events (e.g., API_REQUEST_STARTED from events.api, TOOL_INVOKE_START from events.tool). Import directly: from synthorg.observability.events.<domain> import EVENT_CONSTANT.
Use structured logging with kwargs: logger.info(EVENT, key=value) — never use string formatting like logger.info('msg %s', val).
Do not use from __future__ import annotations — Python 3.14 has native PEP 649 lazy annotations.
Use except A, B: syntax (no parentheses) for exception handling as per PEP 758 on Python 3.14, enforced by ruff.
All public functions and classes must have type hints. Use mypy strict mode for type checking.
Use Google-style docstrings required on all public classes and functions, enforced by ruff D rules.
Create new objects for immutability; never mutate existing ones. For non-Pydantic internal collections (registries, BaseTool), use copy.deepcopy() at construction + MappingProxyType wrapping for read-only enforcement.
For dict/list fields in frozen Pydantic models, rely on frozen=True for field reassignment prevention and copy.deepcopy() at system boundaries (tool execution, LLM provider serialization, inter-agent delegation, serializing for persistence).
Use frozen Pydantic models for config/identity; use separate mutable-via-copy models (using model_copy(update=...)) for runtime state that evolves (e.g. agent execution state, task progress). Never mix static config fields with mutable runtime fields in one model.
Use Pydantic v2 (BaseModel, model_validator, computed_field, ConfigDict). Use @computed_field for derived values instead of storing + validating redundant fields.
Use NotBlankStr (from core.types) for all id...

Files:

src/synthorg/api/middleware.py
tests/unit/api/test_middleware.py

src/synthorg/**/*.py

📄 CodeRabbit inference engine (CLAUDE.md)

Do not use vendor-specific names (Anthropic, OpenAI, Claude, GPT, etc.) in project-owned code, docstrings, comments, tests, or config examples. Use generic names: example-provider, example-large-001, example-medium-001, example-small-001, large/medium/small as aliases.

Files:

src/synthorg/api/middleware.py

tests/**/*.py

📄 CodeRabbit inference engine (CLAUDE.md)

tests/**/*.py: Use vendor-agnostic test names: test-provider, test-small-001, etc. Never use real vendor names (Anthropic, OpenAI, Claude, GPT, etc.) in tests.
Mark tests with @pytest.mark.unit, @pytest.mark.integration, @pytest.mark.e2e, or @pytest.mark.slow.
Maintain 80% minimum code coverage (enforced in CI). Use pytest-xdist with -n auto — always include -n auto when running pytest, never run tests sequentially.
Set test timeout to 30 seconds per test. Use asyncio_mode = 'auto' in pytest config — no manual @pytest.mark.asyncio needed.
Prefer @pytest.mark.parametrize for testing similar cases.
Use Hypothesis for property-based testing with @given + @settings. Profiles: ci (50 examples, default) and dev (1000 examples), controlled via HYPOTHESIS_PROFILE env var. Never skip, dismiss, or ignore flaky tests — always fix them fully and fundamentally. For timing-sensitive tests, mock time.monotonic() and asyncio.sleep() to make them deterministic.

Files:

tests/unit/api/test_middleware.py

🧠 Learnings (11)

📚 Learning: 2026-03-19T09:01:47.243Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-19T09:01:47.243Z
Learning: CLI workflow (`.github/workflows/cli.yml`) runs Go lint (golangci-lint + go vet) + test (race, coverage) + build (cross-compile matrix) + vulnerability check (govulncheck) + fuzz testing. Cross-compiles for linux/darwin/windows × amd64/arm64. GoReleaser release on v* tags with cosign keyless signing and SLSA L3 attestations.

Applied to files:

docs/security.md

📚 Learning: 2026-03-19T09:01:47.243Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-19T09:01:47.243Z
Learning: Docker workflow (`.github/workflows/docker.yml`) builds backend + web + sandbox images, pushes to GHCR, signs with cosign, performs Trivy/Grype scans (CRITICAL = hard fail, HIGH = warn-only), and generates SLSA L3 provenance attestations. Images only pushed after scans pass.

Applied to files:

docs/security.md

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Applies to .github/workflows/docker.yml : CI Docker: build → scan → push to GHCR + cosign sign + SLSA L3 provenance via attest-build-provenance (images only pushed after Trivy/Grype scans pass).

Applied to files:

docs/security.md

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Pre-commit hooks: trailing-whitespace, end-of-file-fixer, check-yaml, check-toml, check-json, check-merge-conflict, check-added-large-files, no-commit-to-branch (main), ruff check+format, gitleaks, hadolint (Dockerfile linting).

Applied to files:

docs/security.md

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Commits: <type>: <description> — types: feat, fix, refactor, docs, test, chore, perf, ci. Enforced by commitizen (commit-msg hook). Signed commits: required on main via branch protection — all commits must be GPG/SSH signed.

Applied to files:

docs/security.md

📚 Learning: 2026-03-19T09:01:47.243Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-19T09:01:47.243Z
Learning: PR Preview workflow (`.github/workflows/pages-preview.yml`) builds site on PRs and workflow_dispatch. Injects 'Development Preview' banner and deploys to Cloudflare Pages. Each PR gets unique preview URL at `pr-<number>.synthorg-pr-preview.pages.dev`. Cleanup job deletes preview on PR close.

Applied to files:

docs/security.md

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Pre-push hooks: mypy type-check + pytest unit tests + golangci-lint + go vet + go test (CLI, conditional on cli/**/*.go) (fast gate before push, skipped in pre-commit.ci — dedicated CI jobs already run these).

Applied to files:

docs/security.md

📚 Learning: 2026-03-19T09:01:47.243Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-19T09:01:47.243Z
Learning: Pages workflow (`.github/workflows/pages.yml`) exports OpenAPI schema via `scripts/export_openapi.py`, builds Astro landing + Zensical docs, copies CLI install scripts to `/get/`, merges, and deploys to GitHub Pages on push to main.

Applied to files:

docs/security.md

📚 Learning: 2026-03-19T09:01:47.243Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-19T09:01:47.243Z
Learning: Applies to .pre-commit-config.yaml : Configure hooks: trailing-whitespace, end-of-file-fixer, check-yaml, check-toml, check-json, check-merge-conflict, check-added-large-files, no-commit-to-branch (main), ruff check+format, gitleaks, hadolint. Pre-push hooks: mypy + pytest unit + golangci-lint + go vet + go test (conditional on cli changes).

Applied to files:

docs/security.md

📚 Learning: 2026-03-19T09:01:47.243Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-19T09:01:47.243Z
Learning: Applies to **/*.py : Use event name constants from domain-specific modules under `synthorg.observability.events` (e.g., `API_REQUEST_STARTED` from `events.api`, `TOOL_INVOKE_START` from `events.tool`). Import directly: `from synthorg.observability.events.<domain> import EVENT_CONSTANT`.

Applied to files:

src/synthorg/api/middleware.py

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Applies to src/synthorg/**/*.py : Event names: always use constants from domain-specific modules under synthorg.observability.events (e.g., PROVIDER_CALL_START from events.provider, BUDGET_RECORD_ADDED from events.budget, etc.). Import directly: `from synthorg.observability.events.<domain> import EVENT_CONSTANT`.

Applied to files:

src/synthorg/api/middleware.py

🪛 LanguageTool

docs/security.md

[uncategorized] ~211-~211: The official name of this software platform is spelled with a capital “H”.
Context: ...he ZAP API scan runs with a rules file (.github/zap-rules.tsv) that suppresses validat...

(GITHUB)

🔇 Additional comments (11)

docs/security.md (3)

90-91: Path-aware header documentation is clear and aligned with the security behavior.

Good update: the API/docs split for Cross-Origin-Opener-Policy and Cache-Control is explicit and easy to audit.

203-203: DAST schedule wording is precise and actionable.

This cadence statement is clear for operators and reviewers.

209-225: DAST tuning documentation is well-structured and review-friendly.

The rule table plus rationale makes suppressions auditable, and keeping Non-Storable Content at Warn preserves useful scan signal.

src/synthorg/api/middleware.py (5)

1-13: LGTM!

Module docstring accurately documents the new Cache-Control path-awareness.

30-34: LGTM!

Event constant imported correctly from the domain-specific module per coding guidelines.

66-88: LGTM!

Well-designed constants with clear documentation. Wiring _API_CACHE_CONTROL into _SECURITY_HEADERS prevents silent divergence between the default and the named constant.

124-137: LGTM!

Path-aware header logic is correctly implemented. The boundary conditions properly distinguish /docs and /docs/* from similar-looking paths like /documents and /docsearch.

206-211: LGTM!

Event constant usage aligns with coding guidelines for observability events. Based on learnings: "Use event name constants from domain-specific modules under synthorg.observability.events".

tests/unit/api/test_middleware.py (3)

12-20: LGTM!

Importing the private constants for testing ensures tests remain in sync with implementation and makes assertions more resilient to value changes.

140-184: LGTM!

Excellent parametrized test coverage with explicit boundary condition tests for /documents and /docsearch. COOP assertions correctly verify the updated same-origin-allow-popups for docs paths.

190-225: LGTM!

Well-structured parametrized tests with descriptive IDs. Coverage mirrors CSP tests, ensuring consistent boundary condition verification.

tests/unit/api/test_middleware.py

Rename test_docs_cache_does_not_suppress_coop_relaxation to test_docs_path_applies_cache_and_coop_relaxations -- clearer intent, body and assertions unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

🤖 I have created a release *beep* *boop* --- ## [0.3.7](v0.3.6...v0.3.7) (2026-03-19) ### Features * **engine:** implement Hybrid Plan + ReAct execution loop ([#582](#582)) ([008147c](008147c)) * implement first-run setup wizard ([#584](#584)) ([dfed931](dfed931)) ### Bug Fixes * **api:** address ZAP DAST scan findings ([#579](#579)) ([ce9a3e0](ce9a3e0)) * **cli:** regenerate compose and re-exec binary on update ([#576](#576)) ([3f226eb](3f226eb)) ### CI/CD * add SBOM generation to Docker and CLI releases ([#580](#580)) ([db459cf](db459cf)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [0.3.7](v0.3.6...v0.3.7) (2026-03-19) ### Features * **engine:** implement Hybrid Plan + ReAct execution loop ([#582](#582)) ([008147c](008147c)) * implement first-run setup wizard ([#584](#584)) ([dfed931](dfed931)) ### Bug Fixes * **api:** address ZAP DAST scan findings ([#579](#579)) ([ce9a3e0](ce9a3e0)) * **cli:** auto-delete binary on Windows, prune images, fix GoReleaser ([#590](#590)) ([eb7c691](eb7c691)) * **cli:** regenerate compose and re-exec binary on update ([#576](#576)) ([3f226eb](3f226eb)) ### CI/CD * add SBOM generation to Docker and CLI releases ([#580](#580)) ([db459cf](db459cf)) ### Maintenance * **main:** release 0.3.7 ([#583](#583)) ([bf58779](bf58779)) * reset failed v0.3.7 release ([#591](#591)) ([b69000d](b69000d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).  ## Summary by CodeRabbit * **New Features** * Added engine Hybrid Plan + ReAct execution loop * Added first-run setup wizard * **Bug Fixes** * Addressed ZAP DAST scan issues * Fixed CLI Windows/image/update issues * **Maintenance** * Added SBOM generation for Docker/CLI releases * General maintenance updates

🤖 I have created a release *beep* *boop* --- ## [0.3.7](v0.3.6...v0.3.7) (2026-03-19) ### Features * **engine:** implement Hybrid Plan + ReAct execution loop ([#582](#582)) ([008147c](008147c)) * implement first-run setup wizard ([#584](#584)) ([dfed931](dfed931)) ### Bug Fixes * **api:** address ZAP DAST scan findings ([#579](#579)) ([ce9a3e0](ce9a3e0)) * **ci:** reset failed v0.3.7 release and fix syft SBOM scan ([#593](#593)) ([d1508c2](d1508c2)) * **cli:** auto-delete binary on Windows, prune images, fix GoReleaser ([#590](#590)) ([eb7c691](eb7c691)) * **cli:** regenerate compose and re-exec binary on update ([#576](#576)) ([3f226eb](3f226eb)) ### CI/CD * add SBOM generation to Docker and CLI releases ([#580](#580)) ([db459cf](db459cf)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [0.3.7](v0.3.6...v0.3.7) (2026-03-19) ### Features * **engine:** implement Hybrid Plan + ReAct execution loop ([#582](#582)) ([008147c](008147c)) * implement first-run setup wizard ([#584](#584)) ([dfed931](dfed931)) ### Bug Fixes * **api:** address ZAP DAST scan findings ([#579](#579)) ([ce9a3e0](ce9a3e0)) * **ci:** remove CLI SBOM generation, reset failed v0.3.7 ([#595](#595)) ([d0f4992](d0f4992)) * **ci:** reset failed v0.3.7 release and fix syft SBOM scan ([#593](#593)) ([d1508c2](d1508c2)) * **cli:** auto-delete binary on Windows, prune images, fix GoReleaser ([#590](#590)) ([eb7c691](eb7c691)) * **cli:** regenerate compose and re-exec binary on update ([#576](#576)) ([3f226eb](3f226eb)) ### CI/CD * add SBOM generation to Docker and CLI releases ([#580](#580)) ([db459cf](db459cf)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

Aureliolo temporarily deployed to ci March 19, 2026 10:38 — with GitHub Actions Inactive

Aureliolo temporarily deployed to cloudflare-preview March 19, 2026 10:38 — with GitHub Actions Inactive

gemini-code-assist bot reviewed Mar 19, 2026

View reviewed changes

coderabbitai bot previously approved these changes Mar 19, 2026

View reviewed changes

Aureliolo dismissed coderabbitai[bot]’s stale review via b42d7b8 March 19, 2026 10:52

Aureliolo temporarily deployed to ci March 19, 2026 10:52 — with GitHub Actions Inactive

Aureliolo temporarily deployed to cloudflare-preview March 19, 2026 10:53 — with GitHub Actions Inactive

coderabbitai bot requested changes Mar 19, 2026

View reviewed changes

tests/unit/api/test_middleware.py Outdated Show resolved Hide resolved

refactor(test): rename test to positive, clearer name

7f4cc0b

Rename test_docs_cache_does_not_suppress_coop_relaxation to test_docs_path_applies_cache_and_coop_relaxations -- clearer intent, body and assertions unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Aureliolo temporarily deployed to ci March 19, 2026 11:16 — with GitHub Actions Inactive

Aureliolo temporarily deployed to cloudflare-preview March 19, 2026 11:17 — with GitHub Actions Inactive

coderabbitai bot approved these changes Mar 19, 2026

View reviewed changes

Merge branch 'main' into fix/zap-scan-findings

a46bbcd

Aureliolo temporarily deployed to ci March 19, 2026 11:21 — with GitHub Actions Inactive

Aureliolo temporarily deployed to cloudflare-preview March 19, 2026 11:22 — with GitHub Actions Inactive

Aureliolo merged commit ce9a3e0 into main Mar 19, 2026
34 checks passed

Aureliolo deleted the fix/zap-scan-findings branch March 19, 2026 11:28

Aureliolo temporarily deployed to cloudflare-preview March 19, 2026 11:28 — with GitHub Actions Inactive

Aureliolo mentioned this pull request Mar 19, 2026

chore(main): release 0.3.7 #583

Merged

coderabbitai bot mentioned this pull request Mar 19, 2026

ZAP API Scan Report #585

Closed

Aureliolo mentioned this pull request Mar 19, 2026

chore(main): release 0.3.7 #592

Merged

Aureliolo mentioned this pull request Mar 19, 2026

chore(main): release 0.3.7 #594

Merged

Aureliolo mentioned this pull request Mar 19, 2026

chore(main): release 0.3.7 #596

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(api): address ZAP DAST scan findings#579

fix(api): address ZAP DAST scan findings#579
Aureliolo merged 4 commits intomainfrom
fix/zap-scan-findings

Aureliolo commented Mar 19, 2026

Uh oh!

github-actions bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Mar 19, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

gemini-code-assist bot commented Mar 19, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

codecov bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Aureliolo commented Mar 19, 2026

Summary

Test plan

Review coverage

Uh oh!

github-actions bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

coderabbitai bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

gemini-code-assist bot commented Mar 19, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

codecov bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions bot commented Mar 19, 2026 •

edited

Loading

coderabbitai bot commented Mar 19, 2026 •

edited

Loading

codecov bot commented Mar 19, 2026 •

edited

Loading