Jeremie Fraeys a8180f1f26 feat(security): HIPAA compliance mode and PHI denylist validation ... Add compliance_mode field to Config with strict HIPAA validation: - Requires SnapshotStore.Secure=true in HIPAA mode - Requires NetworkMode="none" for tenant isolation - Requires non-empty SeccompProfile - Requires NoNewPrivileges=true - Enforces credentials via environment variables only (no inline YAML) Add PHI denylist validation for AllowedSecrets: - Blocks secrets matching patterns: patient, ssn, mrn, medical_record, diagnosis, dob, birth, mrn_number, patient_id, patient_name - Prevents accidental PHI exfiltration via secret channels Add comprehensive test coverage in hipaa_validation_test.go: - Network mode enforcement tests - NoNewPrivileges requirement tests - Seccomp profile validation tests - Inline credential rejection tests - PHI denylist validation tests Closes: compliance_mode, PHI denylist items from security plan		2026-02-23 19:43:19 -05:00
..
audit_test.go	test(security): add comprehensive security unit tests	2026-02-23 18:00:45 -05:00
filetype_test.go	test(security): add comprehensive security unit tests	2026-02-23 18:00:45 -05:00
hipaa_validation_test.go	feat(security): HIPAA compliance mode and PHI denylist validation	2026-02-23 19:43:19 -05:00
path_traversal_test.go	test(security): add comprehensive security unit tests	2026-02-23 18:00:45 -05:00
secrets_test.go	test(security): add comprehensive security unit tests	2026-02-23 18:00:45 -05:00