{"_id":"@chrono-os/security-hardening","_rev":"5-b7b066ed5406fb362a7b9ac57664ffd7","name":"@chrono-os/security-hardening","dist-tags":{"latest":"0.3.1"},"versions":{"0.1.0":{"name":"@chrono-os/security-hardening","version":"0.1.0","keywords":["chrono-os","security","helmet","csp","cors","rate-limit","hardening","lgpd","mobile"],"license":"UNLICENSED","_id":"@chrono-os/security-hardening@0.1.0","maintainers":[{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"}],"homepage":"https://github.com/SugarHoneyIceTea/security-hardening#readme","bugs":{"url":"https://github.com/SugarHoneyIceTea/security-hardening/issues"},"dist":{"shasum":"518d89c0096a3ddd9ace5a6e8183c3b64bf34f2f","tarball":"https://registry.npmjs.org/@chrono-os/security-hardening/-/security-hardening-0.1.0.tgz","fileCount":19,"integrity":"sha512-9BOJ8H8eN6qR62QK86Q0of/6SwJBnhi4b0D7JwB3xJkMoWwSHwCufXvEfDkSbc6KxjfAI6VwB7wOqCx2dM2tvA==","signatures":[{"sig":"MEUCIBwl60OERHXklWKSrnR+X1+d/k94tEABgB/y/ihnLCTsAiEAz9g6lzSp8HsD4JP0WsAdLm90y2/aWijuoH3D9fnO/fw=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":128657},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=20"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./fastify":{"types":"./dist/fastify/index.d.ts","import":"./dist/fastify/index.js","require":"./dist/fastify/index.cjs"}},"gitHead":"d26183856925362704ecc082fff31ab96794b35f","scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit"},"_npmUser":{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"},"repository":{"url":"git+https://github.com/SugarHoneyIceTea/security-hardening.git","type":"git"},"_npmVersion":"11.9.0","description":"Hardening defaults pra apps Fastify do ecossistema Chrono — Helmet + CSP estrito + CORS mobile-ready + rate-limit + cookies seguros + HMAC helpers com timingSafeEqual. Defense in depth + LGPD-compliant + mobile-ready (Capacitor/Ionic/Expo)","directories":{},"_nodeVersion":"24.14.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.0","vitest":"^1.5.0","fastify":"^5.0.0","typescript":"^5.4.0","@types/node":"^20.0.0","@fastify/cors":"^10.0.0","@fastify/helmet":"^12.0.0","@fastify/rate-limit":"^10.0.0"},"peerDependencies":{"fastify":"^5.0.0","@fastify/cors":"^10.0.0","@fastify/helmet":"^12.0.0","@fastify/rate-limit":"^10.0.0"},"peerDependenciesMeta":{"@fastify/cors":{"optional":true},"@fastify/helmet":{"optional":true},"@fastify/rate-limit":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/security-hardening_0.1.0_1779797734908_0.709351485920706","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@chrono-os/security-hardening","version":"0.2.0","keywords":["chrono-os","security","helmet","csp","cors","rate-limit","hardening","lgpd","mobile"],"license":"UNLICENSED","_id":"@chrono-os/security-hardening@0.2.0","maintainers":[{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"}],"homepage":"https://github.com/SugarHoneyIceTea/security-hardening#readme","bugs":{"url":"https://github.com/SugarHoneyIceTea/security-hardening/issues"},"dist":{"shasum":"7ebadc350e05998f1adabf64aae77d01f4596645","tarball":"https://registry.npmjs.org/@chrono-os/security-hardening/-/security-hardening-0.2.0.tgz","fileCount":25,"integrity":"sha512-pzZa3n59kMteZlqh3Z6LwqXdVD1rNLDucfKIpXgAv9bOpA3PuJDVojkM7ei0lYPWMJ7RArrPVeJOtMDHb2XnYw==","signatures":[{"sig":"MEYCIQCqjTF2wdIe04hb0Wh74UFx/DmHIo/YNL6MyOgRoqfP5AIhALGRcADe8XPTuTEZ31Mc1qS6wxS3/Kcc1tEOD0c1p5FN","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":251305},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=20"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./nest":{"types":"./dist/nest.d.ts","import":"./dist/nest.js","require":"./dist/nest.cjs"},"./fastify":{"types":"./dist/fastify/index.d.ts","import":"./dist/fastify/index.js","require":"./dist/fastify/index.cjs"},"./package.json":"./package.json"},"gitHead":"6528701cc3cdebfb27f28bb81527166531d375a4","scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit"},"_npmUser":{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"},"repository":{"url":"git+https://github.com/SugarHoneyIceTea/security-hardening.git","type":"git"},"_npmVersion":"11.9.0","description":"Hardening defaults pra apps Fastify do ecossistema Chrono — Helmet + CSP estrito + CORS mobile-ready + rate-limit + cookies seguros + HMAC helpers com timingSafeEqual. Defense in depth + LGPD-compliant + mobile-ready (Capacitor/Ionic/Expo)","directories":{},"_nodeVersion":"24.14.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.0","vitest":"^1.5.0","fastify":"^5.0.0","typescript":"5.9.3","@types/node":"^20.0.0","@fastify/cors":"^10.0.0","@fastify/helmet":"^12.0.0","@fastify/rate-limit":"^10.0.0"},"peerDependencies":{"fastify":"^5.0.0","@fastify/cors":"^10.0.0","@fastify/helmet":"^12.0.0","@fastify/rate-limit":"^10.0.0"},"peerDependenciesMeta":{"fastify":{"optional":true},"@fastify/cors":{"optional":true},"@fastify/helmet":{"optional":true},"@fastify/rate-limit":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/security-hardening_0.2.0_1788723835803_0.7268960274403891","host":"s3://npm-registry-packages-npm-production"}},"0.2.1":{"name":"@chrono-os/security-hardening","version":"0.2.1","keywords":["chrono-os","security","helmet","csp","cors","rate-limit","hardening","lgpd","mobile"],"license":"UNLICENSED","_id":"@chrono-os/security-hardening@0.2.1","maintainers":[{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"}],"homepage":"https://github.com/SugarHoneyIceTea/security-hardening#readme","bugs":{"url":"https://github.com/SugarHoneyIceTea/security-hardening/issues"},"dist":{"shasum":"b11c7b4d5ab2a886ea0d9afb39dc103d1bb26421","tarball":"https://registry.npmjs.org/@chrono-os/security-hardening/-/security-hardening-0.2.1.tgz","fileCount":25,"integrity":"sha512-ylEcAY4015mrSmXCPtKY0Ey7kOg4kPytDhU+LQMD7/mwFsbDNVdGXjmNwnJpwGnw6bL89kvYxk+fIJSrPxdDdQ==","signatures":[{"sig":"MEQCIERC8OnXluUf60HNSKusoi+3n8bKU4r6fKOqfnFAlyuJAiBr9QhvoSJFaq3Qirz060ofUjhgHaXxj6P1/bFV2gFSYA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":251585},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=20"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./nest":{"types":"./dist/nest.d.ts","import":"./dist/nest.js","require":"./dist/nest.cjs"},"./fastify":{"types":"./dist/fastify/index.d.ts","import":"./dist/fastify/index.js","require":"./dist/fastify/index.cjs"},"./package.json":"./package.json"},"gitHead":"dec29a75766d9cda0360817f65da05755b412538","scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit"},"_npmUser":{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"},"repository":{"url":"git+https://github.com/SugarHoneyIceTea/security-hardening.git","type":"git"},"_npmVersion":"11.9.0","description":"Hardening defaults pra apps Fastify do ecossistema Chrono — Helmet + CSP estrito + CORS mobile-ready + rate-limit + cookies seguros + HMAC helpers com timingSafeEqual. Defense in depth + LGPD-compliant + mobile-ready (Capacitor/Ionic/Expo)","directories":{},"_nodeVersion":"24.14.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.0","vitest":"^1.5.0","fastify":"^5.0.0","typescript":"5.9.3","@types/node":"^20.0.0","@fastify/cors":"^10.0.0","@fastify/helmet":"^12.0.0","@fastify/rate-limit":"^10.0.0"},"peerDependencies":{"fastify":"^5.0.0","@fastify/cors":"^10.0.0","@fastify/helmet":"^12.0.0","@fastify/rate-limit":"^10.0.0"},"peerDependenciesMeta":{"fastify":{"optional":true},"@fastify/cors":{"optional":true},"@fastify/helmet":{"optional":true},"@fastify/rate-limit":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/security-hardening_0.2.1_1788723973210_0.022139383464769846","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@chrono-os/security-hardening","version":"0.3.0","keywords":["chrono-os","security","helmet","csp","cors","rate-limit","hardening","lgpd","mobile"],"license":"UNLICENSED","_id":"@chrono-os/security-hardening@0.3.0","maintainers":[{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"}],"homepage":"https://github.com/SugarHoneyIceTea/security-hardening#readme","bugs":{"url":"https://github.com/SugarHoneyIceTea/security-hardening/issues"},"dist":{"shasum":"cb0556d571e6cf3da6b5c2d8bdbf1f86decd2f70","tarball":"https://registry.npmjs.org/@chrono-os/security-hardening/-/security-hardening-0.3.0.tgz","fileCount":25,"integrity":"sha512-amyXFR8SyZW2kSD/mvASndfzLuM+Io05CjBtgQ9BNSf76iQOPyaHwipQSXZk1DIJL66EsGAdLVk1URavo8B1vw==","signatures":[{"sig":"MEUCIQCnOOVm7F7qbmXx4PXK6xU89UHlMMYUX7XErAHtQmtuVAIgbNZcgEGH/38bYVAc1UvTxWat4TedJQqfecUk28nBoPI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":260279},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=20"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./nest":{"types":"./dist/nest.d.ts","import":"./dist/nest.js","require":"./dist/nest.cjs"},"./fastify":{"types":"./dist/fastify/index.d.ts","import":"./dist/fastify/index.js","require":"./dist/fastify/index.cjs"},"./package.json":"./package.json"},"gitHead":"6ccd48e0fd582a018f9e956b3a3f3d34e31753bc","scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit"},"_npmUser":{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"},"repository":{"url":"git+https://github.com/SugarHoneyIceTea/security-hardening.git","type":"git"},"_npmVersion":"11.9.0","description":"Hardening defaults pra apps Fastify do ecossistema Chrono — Helmet + CSP estrito + CORS mobile-ready + rate-limit + cookies seguros + HMAC helpers com timingSafeEqual. Defense in depth + LGPD-compliant + mobile-ready (Capacitor/Ionic/Expo)","directories":{},"_nodeVersion":"24.14.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.0","vitest":"^1.5.0","fastify":"^5.0.0","typescript":"5.9.3","@types/node":"^20.0.0","@fastify/cors":"^10.0.0","@fastify/helmet":"^12.0.0","@fastify/rate-limit":"^10.0.0"},"peerDependencies":{"fastify":"^5.0.0","@fastify/cors":"^10.0.0","@fastify/helmet":"^12.0.0","@fastify/rate-limit":"^10.0.0"},"peerDependenciesMeta":{"fastify":{"optional":true},"@fastify/cors":{"optional":true},"@fastify/helmet":{"optional":true},"@fastify/rate-limit":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/security-hardening_0.3.0_1788724099863_0.25466141253073915","host":"s3://npm-registry-packages-npm-production"}},"0.3.1":{"name":"@chrono-os/security-hardening","version":"0.3.1","description":"Hardening defaults pra apps Fastify do ecossistema Chrono — Helmet + CSP estrito + CORS mobile-ready + rate-limit + cookies seguros + HMAC helpers com timingSafeEqual. Defense in depth + LGPD-compliant + mobile-ready (Capacitor/Ionic/Expo)","type":"module","main":"./dist/index.cjs","module":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"import":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}},"./fastify":{"import":{"types":"./dist/fastify/index.d.ts","default":"./dist/fastify/index.js"},"require":{"types":"./dist/fastify/index.d.cts","default":"./dist/fastify/index.cjs"}},"./nest":{"import":{"types":"./dist/nest.d.ts","default":"./dist/nest.js"},"require":{"types":"./dist/nest.d.cts","default":"./dist/nest.cjs"}},"./package.json":"./package.json"},"publishConfig":{"registry":"https://registry.npmjs.org","access":"public"},"repository":{"type":"git","url":"git+https://github.com/SugarHoneyIceTea/security-hardening.git"},"license":"UNLICENSED","scripts":{"build":"tsup","dev":"tsup --watch","test":"vitest run","typecheck":"tsc --noEmit"},"peerDependencies":{"fastify":"^5.0.0","@fastify/helmet":"^12.0.0","@fastify/cors":"^10.0.0","@fastify/rate-limit":"^10.0.0"},"peerDependenciesMeta":{"@fastify/helmet":{"optional":true},"@fastify/cors":{"optional":true},"@fastify/rate-limit":{"optional":true},"fastify":{"optional":true}},"devDependencies":{"tsup":"^8.0.0","typescript":"5.9.3","vitest":"^1.5.0","fastify":"^5.0.0","@fastify/helmet":"^12.0.0","@fastify/cors":"^10.0.0","@fastify/rate-limit":"^10.0.0","@types/node":"^20.0.0"},"engines":{"node":">=20"},"keywords":["chrono-os","security","helmet","csp","cors","rate-limit","hardening","lgpd","mobile"],"gitHead":"de31b7a6fbdf538ca4cbb4eee25f84c8d5e92a23","_id":"@chrono-os/security-hardening@0.3.1","bugs":{"url":"https://github.com/SugarHoneyIceTea/security-hardening/issues"},"homepage":"https://github.com/SugarHoneyIceTea/security-hardening#readme","_nodeVersion":"24.14.0","_npmVersion":"11.9.0","dist":{"integrity":"sha512-ToniUWfu7LpjQpEqDysX562/guiEor9uPtATJ1HeACdrp3idgMFk+3kp2xuZyJgaJHEX2caMYLxuywMDhyNZaQ==","shasum":"c9196bcc8937cea1d83f46c52bac2368b284d50f","tarball":"https://registry.npmjs.org/@chrono-os/security-hardening/-/security-hardening-0.3.1.tgz","fileCount":25,"unpackedSize":260938,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQD1vwhUQekCsi3lYTOUFFmD5T0RRyQuVfLQuxVZAIW+0AIge3C85vRZvZpPefY8fqcZeYTnx80qEbJ8dJLUvdHbpqM="}]},"_npmUser":{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"},"directories":{},"maintainers":[{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/security-hardening_0.3.1_1789076654490_0.4208177595910316"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-26T12:15:34.743Z","modified":"2026-09-10T21:44:14.874Z","0.1.0":"2026-05-26T12:15:35.077Z","0.2.0":"2026-09-06T19:43:55.957Z","0.2.1":"2026-09-06T19:46:13.340Z","0.3.0":"2026-09-06T19:48:20.002Z","0.3.1":"2026-09-10T21:44:14.639Z"},"bugs":{"url":"https://github.com/SugarHoneyIceTea/security-hardening/issues"},"license":"UNLICENSED","homepage":"https://github.com/SugarHoneyIceTea/security-hardening#readme","keywords":["chrono-os","security","helmet","csp","cors","rate-limit","hardening","lgpd","mobile"],"repository":{"type":"git","url":"git+https://github.com/SugarHoneyIceTea/security-hardening.git"},"description":"Hardening defaults pra apps Fastify do ecossistema Chrono — Helmet + CSP estrito + CORS mobile-ready + rate-limit + cookies seguros + HMAC helpers com timingSafeEqual. Defense in depth + LGPD-compliant + mobile-ready (Capacitor/Ionic/Expo)","maintainers":[{"name":"sugarhoneyicetea","email":"aquilaferraz@gmail.com"}],"readme":"# @chrono-os/security-hardening\n\nDefaults seguros pra apps Fastify do ecossistema Chrono. **Defense in depth + LGPD-compliant + mobile-ready** (Capacitor/Ionic/Expo).\n\n## Status\n\n🆕 **0.1.0 — 2026-05-26** — pré-publicação. Aguardando `NPM_TOKEN` no repo GitHub.\n\n## O que oferece\n\n- `buildHelmetConfig(opts)` — Helmet com HSTS preload + X-Frame DENY + nosniff + Referrer-Policy strict + Permissions-Policy restritiva\n- `buildCspConfig(opts)` — Content-Security-Policy estrito (default-src 'self', sem unsafe-inline em scripts)\n- `buildCorsConfig(opts)` — CORS mobile-ready (Capacitor/Ionic/Expo) + web origins + credentials\n- `buildRateLimitConfig(opts)` — rate-limit 100/min anônimo, 200/min autenticado, com tier por endpoint\n- `buildSecureCookieAttrs(env)` — cookie attrs seguros (`__Host-` + `HttpOnly` + `Secure` em prod + `SameSite=Lax`)\n- `hmacSign/Verify` + `hmacSignToken/VerifyToken` — HMAC-SHA256 com comparação constant-time\n- Constantes: `MOBILE_CORS_ORIGINS`, `EXPO_DEV_ORIGINS`, `BODY_LIMITS`, `RATE_LIMITS`\n\n## Install\n\n```bash\nyarn add @chrono-os/security-hardening @fastify/helmet @fastify/cors @fastify/rate-limit\n```\n\n## Uso\n\n```ts\nimport Fastify from 'fastify'\nimport fastifyHelmet from '@fastify/helmet'\nimport fastifyCors from '@fastify/cors'\nimport fastifyRateLimit from '@fastify/rate-limit'\nimport {\n  buildHelmetConfig,\n  buildCspConfig,\n  buildCorsConfig,\n  buildRateLimitConfig,\n  SENSITIVE_RATE_LIMIT,\n} from '@chrono-os/security-hardening/fastify'\n\nconst env = process.env.NODE_ENV as 'production' | 'development'\n\nconst app = Fastify({\n  logger: true,\n  bodyLimit: 10 * 1024 * 1024, // 10MB\n})\n\nawait app.register(fastifyHelmet, {\n  ...buildHelmetConfig({ env }),\n  contentSecurityPolicy: buildCspConfig({\n    env,\n    apiUrl: 'https://api.meusite.com.br',\n    additionalConnectSrc: ['https://api.mercadopago.com'],\n    additionalFormAction: ['https://www.mercadopago.com'],\n  }),\n})\n\nawait app.register(fastifyCors, buildCorsConfig({\n  env,\n  webOrigins: ['https://meusite.com.br'],\n  enableMobile: true, // Capacitor/Ionic schemes\n}))\n\nawait app.register(fastifyRateLimit, buildRateLimitConfig({}))\n\n// Override por endpoint sensível\napp.post('/auth/sign-in', {\n  config: { rateLimit: SENSITIVE_RATE_LIMIT },\n}, async (req, reply) => { /* ... */ })\n```\n\n## Bootstrap mode\n\nSem `@fastify/helmet`/`cors`/`rate-limit` instalados (peer deps optional), o pacote ainda exporta helpers genéricos (HMAC, cookies, constants). Os `build*Config` retornam objetos que você passa direto pros plugins quando instalá-los.\n\n## API\n\n### Genérico (`@chrono-os/security-hardening`)\n- `hmacSign(payload, secret)` → string hex\n- `hmacVerify(payload, signature, secret)` → boolean (constant-time)\n- `hmacSignToken(payload, secret)` → token compacto `<payload>.<sig>` base64url\n- `hmacVerifyToken(token, secret)` → `{ ok: true, payload } | { ok: false, reason }`\n- `buildSecureCookieAttrs({ env, sameSite?, maxAge? })`\n- `prefixCookieName(name, env)` → `__Host-${name}` em prod\n- `MOBILE_CORS_ORIGINS`, `EXPO_DEV_ORIGINS`, `BODY_LIMITS`, `RATE_LIMITS`\n\n### Fastify (`@chrono-os/security-hardening/fastify`)\n- `buildHelmetConfig({ env, frameAncestors?, permissionsPolicy? })`\n- `buildPermissionsPolicyHeader(opts?)`\n- `buildCspConfig({ env, apiUrl?, additionalConnectSrc?, nonces?, additionalScriptSrc?, additionalFormAction?, additionalImgSrc? })`\n- `buildCorsConfig({ env, webOrigins, enableMobile?, additionalOrigins?, credentials?, exposedHeaders? })`\n- `buildRateLimitConfig({ max?, timeWindow?, keyGenerator?, skipOnError?, redis? })`\n- `SENSITIVE_RATE_LIMIT`, `FORM_SUBMIT_RATE_LIMIT`, `AUTHENTICATED_RATE_LIMIT`\n\n## Mobile-ready\n\nCORS aceita schemes de apps mobile: `capacitor://localhost`, `ionic://localhost`, `http://localhost` (Capacitor Android), `expo://*` (Expo).\n\nRate-limit por bearer token (não só IP) — apps mobile compartilham IP entre usuários (NAT carrier).\n\n## LGPD\n\n- Cookies seguros (`__Host-` + `HttpOnly` + `Secure` em prod) protegem session token de XSS\n- CSP estrito reduz ataque XSS que poderia roubar dados pessoais\n- Pacote complementar: `@chrono-os/observability` (Pino redaction)\n- Pacote complementar: `@chrono-os/admin-audit` (audit log de mutações)\n\n## Versionamento\n\nSemVer. Releases via tag `v*` em [SugarHoneyIceTea/security-hardening](https://github.com/SugarHoneyIceTea/security-hardening). Ver [CHANGELOG.md](CHANGELOG.md).\n\n## Security\n\nPolítica em [SECURITY.md](SECURITY.md). Reportar vulnerabilidades por e-mail.\n","readmeFilename":"README.md"}