Prepare 1.0.1 security hardening

Author: eldryoth

.cargo/audit.toml

@@ -5,5 +5,5 @@ fetch = true
 stale = false
 
 [yanked]
-enabled = false
-update_index = false
+enabled = true
+update_index = true

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "hashavatar-api"
-version = "1.0.0"
+version = "1.0.1"
 edition = "2024"
 rust-version = "1.96"
 description = "Public avatar API and landing page for hashavatar"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "hashavatar-api"
-version = "1.0.0"
+version = "1.0.1"
 edition = "2024"
 rust-version = "1.96"
 description = "Public avatar API and landing page for hashavatar"

Cargo.toml.split-template

@@ -11,7 +11,7 @@ audit, SBOM, reproducibility, smoke, and GitHub CodeQL default setup checks.
 
 ## Current Status
 
-The current service version is `1.0.0`.
+The current service version is `1.0.1`.
 
 Implemented now:
 
@@ -213,11 +213,17 @@ Object storage:
 - `HASHAVATAR_S3_ENDPOINT`
 - `HASHAVATAR_S3_PATH_STYLE`
 - `HASHAVATAR_S3_PREFIX`
-- `HASHAVATAR_S3_PRESIGN_TTL_SECONDS`
+- `HASHAVATAR_S3_PRESIGN_TTL_SECONDS` clamped to `60..=604800`
 
 `HASHAVATAR_TRUSTED_PROXIES` accepts a comma or whitespace separated list of IP
 addresses and CIDR ranges. Forwarded client IP headers are ignored unless the
-direct peer address matches this allowlist.
+direct peer address matches this allowlist. Keep this allowlist limited to
+proxies that overwrite or correctly append client IP headers; rate-limit state
+is intentionally sized for the real client IP space of the deployment.
+
+Do not proxy `/metrics` from a public listener. The endpoint is intended for
+local scraping only; a same-host reverse proxy can make the loopback peer check
+pass if it forwards the route.
 
 ## Testing And Release Evidence
 

README.md

@@ -14,6 +14,11 @@ The app uses the direct peer IP for rate limiting by default. The compose file
 sets `HASHAVATAR_TRUSTED_PROXIES=10.89.42.0/24` and pins the private network to
 that subnet so the app only honors `X-Forwarded-For` style headers from the
 Fluxheim network. Do not expose the app container port directly to the internet.
+Keep this trusted-proxy range aligned with the private proxy network; widening it
+can let untrusted peers inflate rate-limit key cardinality.
+Do not add a Fluxheim route for `/metrics`: the application also checks for a
+loopback peer, but a same-host reverse proxy connects from loopback and would
+make metrics public if explicitly forwarded.
 
 The app container is hardened for the expected runtime shape: read-only root
 filesystem, no new privileges, all Linux capabilities dropped, and a small