Hermes Agent fe3f810b56 stage-346: apply Opus SHOULD-FIX (defense-in-depth) — scope /api/csp-report auth bypass to POST only ...

Opus advisor flagged that PR #2160's CSP-report auth carve-out covered all
write methods on the path, not just POST. Currently harmless (PATCH/DELETE
fall through to CSRF 403 or routing 404), but defense-in-depth — scope the
bypass to its actual use case.

CSP report regression suite (6 tests) still passes.

2026-05-13 07:15:53 +00:00

19 KiB

Raw Blame History

View Raw