feat: Additional Security Enhancements (Issue #365)

[Wikid82]

Summary

Implements additional security enhancements as outlined in Issue #365.

Security Threats Addressed

High Priority

• Supply Chain Attacks - SBOM generation, enhanced Trivy scanning
• Timing Attacks - Constant-time comparison for tokens
• Session Hijacking - CSP headers implementation

Medium Priority

• Privilege Escalation - Container hardening documentation
• DNS Hijacking - DoH/DoT deployment guide

Documentation Updates

• TLS minimum version documentation in security.md
• Least-privilege container execution guide
• Security Incident Response Plan (SIRP)

Future Considerations (Out of Scope)

• CT log monitoring (separate issue)
• MFA via Authentik integration (separate issue)
• SSO for Charon admin (separate issue)
• Audit logging for compliance (separate issue)

Related Issues

Closes #365

Checklist

• Backend tests pass with 85%+ coverage
• Frontend tests pass with 85%+ coverage
• Pre-commit hooks pass
• Security scans pass (CodeQL, Trivy)
• Documentation updated

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/internal/api/handlers/user_handler.go	0.00%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR implements security enhancements from Issue #365, focusing on timing attack prevention, supply chain security, and comprehensive security documentation. The changes include constant-time token comparison utilities, SBOM generation in CI/CD, and extensive documentation for TLS security, DNS hijacking protection, container hardening, and incident response procedures.

Key Changes:

• Added constant-time comparison utilities to prevent timing attacks on sensitive token operations
• Implemented SBOM generation and attestation in the Docker build workflow for supply chain transparency
• Created comprehensive Security Incident Response Plan (SIRP) documentation
• Enhanced security documentation covering TLS, DNS, and container hardening best practices

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
backend/internal/util/crypto.go	New constant-time comparison utilities for secure token validation
backend/internal/util/crypto_test.go	Comprehensive tests and benchmarks for crypto utilities
backend/internal/api/handlers/user_handler.go	Applied constant-time comparison to invite token verification
docs/security.md	Added TLS security, DNS security, and container hardening sections
docs/security-incident-response.md	New comprehensive incident response plan documentation
docs/getting-started.md	Added security update notification guidance
.github/workflows/docker-build.yml	Added SBOM generation and attestation steps
docs/reports/qa_report.md	Updated QA report for Issue #365 testing results
docs/plans/issue-365-additional-security.md	Planning document for security enhancements
docs/plans/current_spec.md	Implementation specification with codebase analysis
docs/issues/issue-365-manual-test-plan.md	Manual testing procedures for security features

Comments suppressed due to low confidence (1)

docs/security-incident-response.md:401

• The file ends with a closing markdown code fence that should be removed. This closing fence corresponds to the unnecessary opening fence at line 1.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.