GeiserX/Telegram-Archive v6.2.3 on GitHub

Dependabot configuration — Automated dependency updates for pip (weekly), GitHub Actions (monthly), and Docker base images (weekly). Groups minor/patch updates, ignores major bumps.
Ruff linter and formatter — Configured in pyproject.toml with CI workflow. Replaces flake8/black/isort with a single fast tool. Entire codebase auto-formatted.
Pre-commit hooks — .pre-commit-config.yaml with Ruff + standard hooks (check-yaml, trailing-whitespace, etc.).
CodeQL security scanning — Weekly SAST analysis plus on every PR.
SECURITY.md — Responsible disclosure policy with supported versions and scope.
CONTRIBUTING.md — Developer setup guide, branch naming, commit conventions, and testing instructions.
PR template — Checklists for type of change, database changes, data consistency, testing, and security.
CODEOWNERS — Routes all PR reviews to @GeiserX.
.editorconfig — Consistent formatting across editors (UTF-8, LF, Python 4-space, YAML 2-space).
Content-Security-Policy headers — CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy on all responses.
CORS_ORIGINS environment variable — Configure allowed CORS origins (default: * without credentials).
SECURE_COOKIES environment variable — Control secure flag on auth cookie (default: true; set false for local HTTP development).

CORS misconfiguration — Removed allow_credentials=True when using wildcard origins (browser security requirement). Restricted allowed methods to GET/POST.
/internal/push access control — Endpoint now enforces private IP allowlist (loopback + RFC 1918 ranges) instead of silently allowing all requests.
Auth cookie missing secure flag — Cookie now sets secure=True by default, preventing transmission over plain HTTP.

Docker Compose security hardening — Both services now use read_only: true, cap_drop: [ALL], security_opt: [no-new-privileges:true], and tmpfs: [/tmp]. Viewer volume mounted read-only.
GitHub Actions bumped — docker/build-push-action v5→v6, codecov/codecov-action v4→v5.
Removed .cursor/rules/project.mdc — Redundant with AGENTS.md which is the single source of truth for AI assistant configuration.

📋 Full changelog: docs/CHANGELOG.md