OWASP Top 10 (2025): hardening from the controls review AB#309509 #607

Why

We reviewed the service against the OWASP Top 10 (2025) controls list. For each control we recorded
the service controls and the DevOps / infrastructure controls. This epic holds the hardening work
that the review found.

Scope

• Code and configuration changes in this repository.
• Requests to the DfE platform team for the shared Terraform modules and GitHub actions.
• Items that the team must confirm (process, not code).

Done when

• Every child issue is closed.
• The OWASP Top 10 controls document is updated with the outcome of each child.

AB#309509