Complete security hardening implementation including HTTPS enforcement, security headers, rate limiting, and comprehensive security test suite. Key features: - HTTPS enforcement with HSTS support - Security headers (CSP, X-Frame-Options, X-Content-Type-Options) - Rate limiting for all critical endpoints - Enhanced email template security - 87% test coverage with security-specific tests Architect approval: 9.5/10 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>
Project Standards
This directory contains all project-wide standards and conventions for the IndieAuth server implementation.
Standard Documents
Core Standards
- versioning.md - Semantic versioning approach (v2.0.0)
- git.md - Trunk-based development workflow
- testing.md - Testing strategy with 80% minimum coverage
- coding.md - Python coding standards and conventions
- development-environment.md - uv-based environment management and workflow
Key Decisions
Technology Stack (Approved)
- Language: Python 3.10+
- Framework: FastAPI
- Database: SQLite
- Environment Management: uv (with direct execution model)
- Testing: pytest with 80% minimum coverage
- Code Quality: Black, Ruff, mypy
Development Workflow
- Git: Trunk-based development on
mainbranch - Environments: Direct execution via
uv run(no activation) - Testing: TDD preferred, behavior-focused tests
- Documentation: Comprehensive before implementation
Quick Reference
Daily Commands
# Run application
uv run uvicorn src.main:app --reload
# Run tests
uv run pytest
# Add dependency
uv pip install package
uv pip freeze > requirements.txt
# Code quality
uv run ruff check .
uv run mypy src
Standards Compliance
All code must:
- Pass linting (Ruff)
- Pass type checking (mypy)
- Have 80%+ test coverage (90% for new code)
- Follow PEP 8 and project conventions
- Be documented with clear docstrings
Status
✅ Standards Finalized: 2025-11-20
All foundational standards have been defined and documented. These standards form the basis for all implementation work on the IndieAuth server project.