Turn security
into a repeatable test.

1 — Input and output

Submit an empty title, then one containing <script>alert(1)</script>. The first should produce 422 with a field error. The second may be stored as text but must never execute a script in the list.

2 — CSRF

Temporarily remove csrfField() from a local form copy and submit POST. Expect 419. Restore the field immediately: a security test must not become a regression.

3 — Cookies and headers

curl -I http://127.0.0.1:8910/books

Find Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Secure and HSTS appear when the request is genuinely HTTPS.

4 — Rate limiting

In a test environment only, reduce limit to 2, send three valid POST requests to the same path, and confirm 429 with Retry-After. Then restore 60.

5 — Production

aml test
aml doctor --production