B-050 — Helmet / security headers baseline

[Junman140]

Severity: Medium · Area: backend/security · Evidence: acbu-backend/src/index.ts
Impact: Missing headers increase XSS/clickjacking impact for any HTML served. Fix direction: Helmet defaults + CSP for any static docs. Acceptance check: securityheaders.io A- or documented exceptions.

[drips-wave]

Congratulations, @Shadow-MMN! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on April 29, 2026.

🧑‍💻 @Shadow-MMN: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been marked as completed by a Drips Wave moderator for @Shadow-MMN as part of the Stellar Wave Program's 4th Wave 🥳

Moderator's reason: [Auto-assessed] The PR #208 in Pi-Defi-world/acbu-backend was merged by the maintainers and directly addresses the security header requirements specified in issue #165. Although the PR includes significant unrelated schema changes, the merge status confirms maintainer acceptance of the work.

😎 @Shadow-MMN: You earned 150 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

ℹ️ Note: This issue was marked complete via moderation. Points were issued even though the GitHub issue remains open.