security: guardrails for untrusted portal content; scope credentials across redirects

.github/dependabot.yml

@@ -0,0 +1,34 @@
+version: 2
+updates:
+  # Python dependencies (pyproject.toml / uv.lock, requirements*.txt)
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      python-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Go client
+  - package-ecosystem: "gomod"
+    directory: "/client"
+    schedule:
+      interval: "weekly"
+
+  # GitHub Actions pins
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Terraform providers/modules
+  - package-ecosystem: "terraform"
+    directory: "/terraform/aws"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "terraform"
+    directory: "/terraform/bootstrap"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -58,15 +58,19 @@ jobs:
   test-suite:
     name: Test suite
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python 3.11
+      - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: ${{ matrix.python-version }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@v4
@@ -75,7 +79,7 @@ jobs:
           cache-dependency-glob: "uv.lock"
 
       - name: Install dependencies
-        run: uv sync --all-extras
+        run: uv sync --all-extras --python ${{ matrix.python-version }}
 
       - name: Run Python tests with coverage
         run: |
@@ -94,3 +98,33 @@ jobs:
       - name: Run Go tests
         working-directory: ./client
         run: go test ./...
+
+  terraform-validate:
+    name: Terraform validate
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "1.9.x"
+
+      - name: Check Terraform formatting
+        run: terraform fmt -check -recursive terraform/
+
+      - name: Validate terraform/aws
+        working-directory: ./terraform/aws
+        run: |
+          # Placeholder for the Lambda artifact referenced by filebase64sha256()
+          touch lambda-deployment.zip
+          terraform init -backend=false -input=false
+          terraform validate
+
+      - name: Validate terraform/bootstrap
+        working-directory: ./terraform/bootstrap
+        run: |
+          terraform init -backend=false -input=false
+          terraform validate

.gitignore

@@ -233,3 +233,8 @@ examples/
 terraform/aws/secrets.*.tfvars
 .env.staging
 .env.prod
+
+# Claude Code local files
+CLAUDE.md
+CLAUDE.local.md
+.claude/

README.md

@@ -46,6 +46,7 @@ See [Getting Started](docs/GETTING_STARTED.md) for full setup.
 | [Architecture](docs/ARCHITECTURE.md)       | System design and plugins                       |
 | [Deployment](docs/DEPLOYMENT.md)           | AWS, Terraform, monitoring                      |
 | [Testing](docs/TESTING.md)                 | Local testing (Terminal, Claude, MCP Inspector) |
+| [Security](docs/SECURITY.md)               | Threat model, prompt-injection guardrails       |
 
 
 ---

config-example.yaml

@@ -51,6 +51,18 @@ plugins:
     city_name: "Your City"
     timeout: 120
     # token: "${ARCGIS_TOKEN}"  # Optional: Bearer token for private items
+    # trusted_service_hosts:      # Extra hosts trusted for Feature Service queries
+    #   - "gis.yourcity.gov"      # (needed when Hub references self-hosted services)
+
+  # Built-in: Opendatasoft (for Opendatasoft Explore v2.1 portals)
+  # Examples: data.longbeach.gov, public.opendatasoft.com
+  opendatasoft:
+    enabled: false # Set to true to use
+    base_url: "https://data.longbeach.gov" # Portal API base URL
+    portal_url: "https://data.longbeach.gov" # Public portal URL
+    city_name: "Long Beach" # City/organization name
+    timeout: 30 # HTTP timeout in seconds
+    # api_key: "${ODS_API_KEY}"  # Optional: only needed for private datasets
 
   # yamllint disable rule:comments-indentation
   # Custom: Add your own plugins here