# Implementation: Harden Dashboard Security

## Summary
- Added CORS headers (`Access-Control-Allow-Origin`, `Methods`, `Headers`) to all API responses via `_send_json()` and `_send_error()`
- Added `do_OPTIONS` handler for CORS preflight requests
- Added `X-Content-Type-Options: nosniff` header to all responses
- Added `MAX_POST_BODY = 65536` (64KB) content-length limit on POST review endpoint
- Added `MAX_REVIEW_COMMENT_LENGTH = 4096` character limit on review comments
- Replaced inline `onclick` handlers in review buttons with `data-task`/`data-status` attributes + event delegation
- Applied `escapeHtml()` to `task.display_name` in `renderTaskCard()`
- Filesystem task name validation was already implemented in `fix-verdict-parsing` (R2 of this SPEC is done)

## Changes
- `automaton/dashboard/ui/app.py`: Added CORS headers, `do_OPTIONS`, content-length bounds, comment truncation
- `automaton/dashboard/html/dashboard.js`: Replaced onclick handlers with data attributes, escaped display_name

## Test Results
119 passed in 0.08s (full suite)
Dashboard starts and serves correct CORS headers on all API responses

## Blockers
None