What is the problem

Closes #199

All /api/v1/* endpoints were publicly accessible with no authentication. Any process on localhost — or any attacker who can reach the port — could trigger scans, read results, and interact with the credential vault without supplying any credentials.

What was changed

Why this approach

• Startup-generated, file-persisted key — no hardcoded secret, survives restarts, rotatable by deleting .api_key
• secrets.compare_digest — constant-time comparison prevents timing oracle attacks
• Router-level dependency — single declaration protects every existing and future route with no per-route boilerplate
• /api/v1/health and / are defined directly on app, not on the router, so they remain unauthenticated for health checks

How to test

# Start backend
cd backend && python -m secuscan

# Unauthenticated — should return 401
curl http://localhost:8000/api/v1/plugins

# Read generated key
API_KEY=$(cat backend/data/.api_key)

# Authenticated via X-Api-Key — should return 200
curl -H "X-Api-Key: $API_KEY" http://localhost:8000/api/v1/plugins

# Authenticated via Bearer — should return 200
curl -H "Authorization: Bearer $API_KEY" http://localhost:8000/api/v1/plugins

Edge cases covered

• Key file created with 0o600 permissions on first run; reloaded on subsequent starts
• _api_key is None (service not yet initialised) returns 503, not 401
• Both Authorization: Bearer and X-Api-Key headers accepted
• CIDR notation (8.8.8.8/32) no longer incorrectly flagged as a filesystem target
• All pre-existing tests updated to pass the API key; test isolation maintained via fixtures

Verification checklist

• pytest testing/backend/ — 261 passed (1 pre-existing failure in test_route_rejects_task_when_limiter_full due to rate-limiter state bleed across the full suite, also failing on main)
• 22 new auth unit tests — all pass
• Unauthenticated requests return 401
• Correct key via X-Api-Key returns 200
• Correct key via Authorization: Bearer returns 200
• is_filesystem_target("8.8.8.8/32") returns False