fix: security hardening (#55, #56, #57, #58)

[jhaydeeee-web]

Closes #55
Closes #56
Closes #57
Closes #58

Summary

6ef949b: fix: restrict externalUrl to http(s) (#58)

Added httpUrlSchema in the new src/lib/externalUrlValidation.ts (with tests) and used it for linkPublishSchema.externalUrl in src/schemas/requests.ts, so javascript: and data: URLs are rejected with 400 while http and https URLs are accepted.

6beca1e: fix: bind compose Postgres to localhost and require password from env (#57)

docker-compose.yml now publishes Postgres on 127.0.0.1:5432 only and reads the password from POSTGRES_PASSWORD (compose fails with a clear message if unset), including in the API's DATABASE_URL. .env.example gains a POSTGRES_PASSWORD entry.

7c0e71f: fix: verify Postgres TLS certificate, support DATABASE_CA_CERT (#56)

src/db/client.ts now connects with rejectUnauthorized: true outside localhost and passes an optional CA from DATABASE_CA_CERT. The setting is documented in the README.

171e381: fix: scope relaxed CSP to /docs only (#55)

src/middleware/security.ts now builds a strict Helmet default policy for all routes and applies the relaxed Swagger policy only to /docs paths. The security header test was extended accordingly.

[vercel]

@jhaydeeee-web is attempting to deploy a commit to the work Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@jhaydeeee-web Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits