Harden auth, payments, and frontend against review findings.

Close exploitable gaps in booking/payment flows, enforce token versioning and account checks, gate sensitive payment data, and add middleware plus input validation across admin routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/index.ts

@@ -56,6 +56,19 @@ app.use(
   })
 );
 
+// Baseline security headers on every response.
+const isProduction = process.env.NODE_ENV === 'production';
+app.use('*', async (c, next) => {
+  await next();
+  c.header('X-Content-Type-Options', 'nosniff');
+  c.header('X-Frame-Options', 'DENY');
+  c.header('Referrer-Policy', 'strict-origin-when-cross-origin');
+  c.header('X-XSS-Protection', '0');
+  if (isProduction) {
+    c.header('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+  }
+});
+
 // OpenAPI specification
 const openApiSpec = {
   openapi: '3.0.0',
@@ -1827,15 +1840,34 @@ const openApiSpec = {
   },
 };
 
-// OpenAPI JSON endpoint
-app.get('/openapi.json', (c) => {
-  return c.json(openApiSpec);
+// API documentation is disabled in production to avoid exposing the full API
+// surface (and schema) to anonymous users. Enable locally / in non-prod only.
+if (!isProduction) {
+  // OpenAPI JSON endpoint
+  app.get('/openapi.json', (c) => {
+    return c.json(openApiSpec);
+  });
+
+  // Swagger UI
+  app.get('/api-docs', swaggerUI({ url: '/openapi.json' }));
+} else {
+  app.get('/openapi.json', (c) => c.json({ error: 'Not Found' }, 404));
+  app.get('/api-docs', (c) => c.json({ error: 'Not Found' }, 404));
+}
+
+// Static file serving for uploads.
+// Uploads are validated as images at write time, but as defense-in-depth we force
+// any non-image path to download as an opaque attachment so a stray/legacy
+// .html/.svg can never be rendered (and therefore never execute script) in-origin.
+app.use('/uploads/*', async (c, next) => {
+  await next();
+  const path = c.req.path.toLowerCase();
+  const isInlineImage = /\.(jpg|jpeg|png|gif|webp|avif)$/.test(path);
+  if (!isInlineImage) {
+    c.header('Content-Disposition', 'attachment');
+    c.header('Content-Type', 'application/octet-stream');
+  }
 });
-
-// Swagger UI
-app.get('/api-docs', swaggerUI({ url: '/openapi.json' }));
-
-// Static file serving for uploads
 app.use('/uploads/*', serveStatic({ root: './' }));
 
 // Health check