Security hardening — Sub-spec C: Platform & Data Protection (019) #96

Feature 019-security-hardening-subspec-c — split from 016 for per-slice context.

Spec: specs/019-security-hardening-subspec-c/spec.md · Branch: 019-security-hardening-subspec-c · Umbrella tasks: US4 (T048–T060, T095)

Scope

• FR-C1: register the PII-scrubbing Serilog enricher (High)
• FR-C2: pagination clamps + limit/offset contract
• FR-C3/C4: telemetry limiter (trusted-edge) + global default limiter
• FR-C5: generic error + correlationId on deployed non-local
• FR-C6: verified email change + input caps
• FR-C7: security headers (repo-controlled middleware)

🤖 Split via Claude Code