Harden HTTP defaults and proxy header trust.

Add explicit server timeout/header limits, require trusted proxy CIDRs when honoring forwarded IP headers, and document single-instance storage expectations.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/http/handlers.go

@@ -44,10 +44,10 @@ func (s *Server) Routes() http.Handler {
 
 	writeHandler := http.HandlerFunc(s.createScratch)
 	middlewares := make([]func(http.Handler) http.Handler, 0, 2)
-	middlewares = append(middlewares, AllowlistMiddleware(s.cfg.Security.AllowedPrefixes, s.cfg.Security.TrustProxyHeaders, s.logger))
+	middlewares = append(middlewares, AllowlistMiddleware(s.cfg.Security.AllowedPrefixes, s.cfg.Security.TrustProxyHeaders, s.cfg.Security.TrustedProxyPrefixes, s.logger))
 	if s.cfg.Security.RateLimit.Enabled {
 		limiter := NewRateLimiter(s.cfg.Security.RateLimit.RequestsPerMinute, s.cfg.Security.RateLimit.Burst)
-		middlewares = append(middlewares, RateLimitMiddleware(limiter, s.cfg.Security.TrustProxyHeaders))
+		middlewares = append(middlewares, RateLimitMiddleware(limiter, s.cfg.Security.TrustProxyHeaders, s.cfg.Security.TrustedProxyPrefixes))
 	}
 	mux.Handle("POST /api/scratch", Chain(writeHandler, middlewares...))
 
@@ -298,7 +298,7 @@ func (s *Server) isUploadAllowedForRequest(r *http.Request) bool {
 		return true
 	}
 
-	clientIP, ok := extractClientIP(r, s.cfg.Security.TrustProxyHeaders)
+	clientIP, ok := extractClientIP(r, s.cfg.Security.TrustProxyHeaders, s.cfg.Security.TrustedProxyPrefixes)
 	if !ok {
 		return false
 	}