chore: add changeset and close task 0001

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: nichochar

.changeset/quiet-moons-shave.md

@@ -0,0 +1,19 @@
+---
+'@srcbook/api': minor
+'srcbook': minor
+---
+
+Reject requests and websocket connections from non-local origins, and bind to loopback by
+default.
+
+Srcbook has no authentication and executes code, so any web page the user visited could
+previously read their provider API keys, read files off disk, and run arbitrary code through
+the websocket. The server also listened on every network interface.
+
+Requests now need a local `Origin` (any port), or one listed in the new
+`SRCBOOK_ALLOWED_ORIGINS` environment variable. Requests without an `Origin` header — the CLI,
+curl, same-origin navigations — are unaffected.
+
+To reach Srcbook from another machine, set `HOST` explicitly (for example `HOST=0.0.0.0`) and
+add the origin you'll browse from to `SRCBOOK_ALLOWED_ORIGINS`. Only do this on a network you
+trust.

tasks/0001-lock-down-network-surface.md

@@ -1,7 +1,7 @@
 ---
 id: 0001
 title: Lock down the network surface (bind, CORS, websocket origin)
-status: TODO
+status: DONE
 created: 2026-07-29
 area: api
 ---
@@ -31,3 +31,24 @@ See `REVIEW.md` §1 for the reproduction.
 
 Keep the allowlist shared between the HTTP and websocket paths — one source of truth, or they
 will drift.
+
+Done in `server/security.mts`. Two things worth remembering:
+
+**CORS headers alone are not a fix.** They stop an attacker _reading_ a response, but the
+request still executes — which is all you need for `POST /api/settings`. Disallowed origins
+have to be rejected outright, so there's a `verifyOrigin` middleware alongside the `cors`
+middleware rather than just `cors` configured with an allowlist.
+
+**Checking the origin in the websocket `connection` handler is too late.** `ws` has already
+completed the handshake by then, so the client sees a socket open and only afterwards get
+torn down. Verified this happening before switching to `verifyClient`, which runs before the
+handshake — a rejected client now gets a 401 and never connects.
+
+Requests with no `Origin` header are allowed on purpose: browsers always set it on
+cross-origin requests, so its absence means a non-browser client (the CLI, curl), and
+rejecting those would break `srcbook import`.
+
+`HOST` was already set by `docker-compose.yml` and read by nothing. It's real now — but note
+it has to be `0.0.0.0` _inside_ a container, because Docker forwards published ports to the
+container IP. Host-side exposure is controlled by `HOST_BIND` on the ports line, which is the
+knob that actually matters there.