Platform update: hardening the stack

We've shipped a round of security and infrastructure hardening across the platform. None of it changes how Ethica works day to day — it changes how much has to go wrong before anything bad can happen. Here's what landed.

A smaller, non-root runtime

The application image was rebuilt onto a distroless base: no shell, no package manager, no perl, no tar — just the Python runtime and the app. The result is a container that's ~80% smaller and ships with zero Critical/High known vulnerabilities, down from eleven on the previous base.

It also runs as a non-root user. If the app were ever compromised, the attacker lands as an unprivileged user inside a near-empty filesystem with no tools to pivot with — a much smaller blast radius.

Defense-in-depth headers, everywhere

Every response now carries X-Content-Type-Options, X-Frame-Options and a Referrer-Policy — not just the admin and API endpoints, but the public pages too. That closes off clickjacking and content-sniffing across the whole site, and session cookies are marked Secure over HTTPS.

SSRF-protected monitoring

The built-in monitoring can probe your own infrastructure — including private, internal hosts, which is the whole point. What it will no longer do is follow a target to a cloud provider's metadata endpoint or other sensitive internal addresses. Server-side fetches now resolve and vet every target first, so a monitor URL can't be turned into a window onto somewhere it shouldn't reach.

Why it matters

Ethica is built on the idea that you should be able to own and reason about your whole stack. That only holds if the stack is honest about its own attack surface — small, legible, and hardened by default. This update is a step in keeping it that way, and there's more on the roadmap.

Every change shipped behind the same full integration test suite that gates all our releases, green from start to finish.