chore(security): Phase 0 hardening — headers, Semgrep CI, deps

[ayoub3bidi]

Contribution workflow

• Base branch is develop: This PR targets develop, not main.
• Guidelines and docs: Read CONTRIBUTING.md; updated SECURITY.md to match deployed security posture.
• This template: PR template structure kept; applicable sections filled below.

Description

Phase 0 security hardening for Bayan Flow (no Supabase/auth work). Adds Netlify HTTP security headers and CSP, wires Semgrep into CI via SEMGREP_APP_TOKEN, tightens GitHub Actions with production dependency auditing and safer fork PR deploy behavior, bumps vulnerable dependencies, and aligns SECURITY.md with reality. Socket continues to run via the org GitHub App (no duplicate CLI workflow).

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📚 Documentation update
• 🎨 Style/UI improvement
• ⚡ Performance improvement
• 🧪 Test addition or improvement
• 🔧 Chore (maintenance, dependencies, etc.)

Related Issues

Fixes #

Changes Made

• Add Netlify security headers in netlify.toml: HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy; align NODE_VERSION to 24.11.1
• Add .github/workflows/semgrep.yml — PR/push scans + weekly scheduled full scan using SEMGREP_APP_TOKEN
• Harden .github/workflows/ci.yml: pnpm audit --prod --audit-level high; skip Actions Netlify deploy for fork PRs
• Bump react-router-dom (≥7.12), vitest (≥3.2.6), playwright (≥1.55.1)
• Update SECURITY.md: accurate third-party call wording, header/CSP documentation, Semgrep/Socket/audit tooling

Algorithm Details (if applicable)

N/A — no algorithm changes.

Testing

• All existing tests pass (pnpm test:run)
• New tests added for new functionality
• Manual testing completed
• Cross-browser testing (if UI changes)

Test Results

Test Files  110 passed (110)
Tests       1533 passed (1533)

pnpm lint                    — pass
pnpm format:check            — pass
pnpm test:coverage           — pass
pnpm build                   — pass
pnpm audit --prod --audit-level high — pass (no high/critical prod issues)

CI / PR checks (PR #182)

• Code Quality, Unit Tests, Build, All Checks Passed
• Semgrep
• Socket Security: Pull Request Alerts
• Netlify Header rules - dev-bayanflow — pass

Manual verification (recommended for reviewers)

• Deploy preview: confirm app loads under CSP (theme, Umami, GitHub badge, Python panel/Pyodide, YouTube click-to-load)
• DevTools → Network: verify security headers on document response
• Optional: open a fork PR and confirm Actions deploy is skipped without failing All Checks Passed

Screenshots/GIFs

N/A — infrastructure and security configuration only; no UI changes.

Code Quality

• Code follows the project's coding standards
• ESLint passes (pnpm lint)
• Prettier formatting applied (pnpm format:check)
• No console errors or warnings
• Code is properly documented with JSDoc (if applicable)

Performance Impact

• No performance impact
• Performance improved
• Performance impact assessed and acceptable
• Performance benchmarks included

CSP and security headers add negligible runtime overhead.

Accessibility

N/A — no UI changes.

Breaking Changes

• None

Checklist

• I have completed the Contribution workflow checklist at the top of this template
• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Additional Notes

GitHub settings (applied via gh, outside this PR diff)

• main required checks: Code Quality, Unit Tests, Build, All Checks Passed, Socket Security: Pull Request Alerts, Semgrep (removed stale Unit Tests (20.x))
• main: 1 required approving review
• Rulesets split: Branch Protection - develop (0 reviews) · Branch Protection - main (1 review); both include non-fast-forward
• Classic API may still show allow_force_pushes: true; non_fast_forward ruleset on main blocks force pushes in practice

Manual dashboard follow-up (post-merge)

• Socket org → Security Policy: set critical supply-chain alert types to Block

• Semgrep Cloud: confirm project linked; enable p/javascript, p/react, p/owasp-top-ten; Block on hardcoded secrets

• Branch: chore/phase-0-security-hardening (from develop)

• PR: chore(security): Phase 0 hardening — headers, Semgrep CI, deps #182

---

Reviewer Guidelines:

• Check that all tests pass
• Verify code follows project standards
• Test the changes locally
• Review for security implications
• Ensure documentation is updated

[netlify]

✅ Deploy Preview for dev-bayanflow ready!

Name	Link
🔨 Latest commit	478426c
🔍 Latest deploy log	https://app.netlify.com/projects/dev-bayanflow/deploys/6a37e1035f5ac700080646bf
😎 Deploy Preview	https://deploy-preview-182--dev-bayanflow.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react-router-dom@​7.18.0
	@​vitest/​coverage-v8@​3.2.6
	vitest@​3.2.6
	playwright@​1.61.0
	@​vitest/​ui@​3.2.6

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!