diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..930d3ed
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+# Dependabot: keep the pinned Python dependency and the CI actions patched.
+# Required by the Wherobots Labs charter (automated dependency scanning).
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/aws-step-functions-python-sdk"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/aws-step-functions-python-sdk/README.md b/aws-step-functions-python-sdk/README.md
index 617cdd4..134fd63 100644
--- a/aws-step-functions-python-sdk/README.md
+++ b/aws-step-functions-python-sdk/README.md
@@ -76,9 +76,9 @@ cd labs-reference-implementations/aws-step-functions-python-sdk
 ```
 
 Use a virtual environment so the Wherobots SDK doesn't pollute your system
-Python. `requirements.txt` holds the only local dependency
-(`wherobots-python-sdk`, used by the upload step — the dashboard server is
-stdlib-only, and the Lambdas install the SDK themselves from PyPI):
+Python. `requirements.txt` holds the only dependency, pinned
+(`wherobots-python-sdk`, used by the upload step and vendored into the
+Lambda zips at deploy time — the dashboard server is stdlib-only):
 
 ```bash
 python3 -m venv .venv
@@ -143,7 +143,7 @@ python3 scripts/01_upload_job.py   # upload job/hello_wherobots_job.py, save s3:
 3. The job runs `try: work; post success` / `except: post failure(traceback)`,
    with a daemon thread posting heartbeats every 60 s. `finally` only stops the
    heartbeat thread — never posts results.
-4. **Happy path**: the success callback (`{building_count: 1084}`) becomes the
+4. **Happy path**: the success callback (`{building_count: 1080}`) becomes the
    state output and **NextStep** runs immediately. **Soft failure**: the failure
    callback fails the task with the traceback as cause → `JobFailed`.
    **Hard death (OOM)**: heartbeats stop → `States.Timeout` after
@@ -182,12 +182,35 @@ python3 scripts/01_upload_job.py   # upload job/hello_wherobots_job.py, save s3:
 | `scripts/` | Numbered lifecycle scripts (the dashboard runs these) |
 | `dashboard/` | Local control-plane server + guided UI |
 
+## Security model (read before exposing anything)
+
+- **The API key never sits in a Lambda env var.** The deploy stores it in
+  **Secrets Manager**; the Lambdas fetch it at cold start under a role that can
+  read exactly that one secret. Reading a function's configuration shows only
+  the secret's ARN.
+- **Dependencies are pinned and vendored.** `requirements.txt` pins
+  `wherobots-python-sdk`, and the deploy vendors it into the Lambda zips —
+  no network installs at cold start, every instance runs the same code.
+- **The callback relay is public by design, throttled, and capability-gated.**
+  The unguessable single-use task token is the auth; Step Functions rejects
+  anything else. The token travels as a plain job argument, so anyone who can
+  read that run's arguments in your Wherobots org (or your Step Functions
+  execution history) could post a forged callback for that one run — both
+  surfaces are already inside your trust boundary. The relay caps payload
+  size, returns generic errors (details go to CloudWatch), and the stage is
+  throttled (burst 10 / rate 5). For production add an authorizer or WAF.
+- **Callback output is treated as untrusted.** The dashboard HTML-escapes
+  every server-sourced value before rendering it.
+- **The dashboard only answers its own page.** Requests must carry a loopback
+  `Host` and (when present) a same-origin `Origin`; lifecycle scripts run only
+  via `POST` + `application/json`, so no other website can trigger a deploy,
+  teardown, or job run while the dashboard is up.
+
 ## Production notes (deliberately out of scope here)
 
-- Bake the SDK into a **Lambda layer** (`pip install wherobots-python-sdk -t python/ && zip -r layer.zip python`) instead of the cold-start pip install.
-- Put `WHEROBOTS_API_KEY` in **Secrets Manager**, not a Lambda env var.
 - Use IaC (Terraform / CDK / SAM) instead of CLI scripts.
 - Add `Catch` + alerting states around Submit and Poll.
+- Put an authorizer (API key / IAM) or WAF in front of the callback route.
 
 ## Cost
 
diff --git a/aws-step-functions-python-sdk/dashboard/index.html b/aws-step-functions-python-sdk/dashboard/index.html
index 34bb3e4..8a4aeff 100644
--- a/aws-step-functions-python-sdk/dashboard/index.html
+++ b/aws-step-functions-python-sdk/dashboard/index.html
@@ -7,8 +7,10 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;600&family=IBM+Plex+Sans+Condensed:wght@500;600;700&family=IBM+Plex+Serif:ital,wght@0,400;0,500;1,400&display=swap">
-<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css">
-<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>
+<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css"
+      integrity="sha384-wH75j6z1lH97ZOpMOInqhgKzFkAInZPPSPlZpYKYTOqsaizPvhQZmAtLcPKXpLyH" crossorigin="anonymous">
+<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"
+        integrity="sha384-F/bZzf7p3Joyp5psL90p/p89AZJsndkSoGwRpXcZhleCWhd8SnRuoYo4d0yirjJp" crossorigin="anonymous"></script>
 <style>
 :root {
   --ground:      #F4F6F7;
@@ -454,7 +456,7 @@ <h1>Wherobots Jobs from Step Functions</h1>
 
   <footer>
     <div>Wherobots reference implementation · Step Functions callback pattern with poller fallback</div>
-    <div>Job: Overture buildings within 1 km of downtown Seattle (geodesic, EPSG:4326) · expected result 1,084</div>
+    <div>Job: Overture buildings within 1 km of downtown Seattle (geodesic, EPSG:4326) · expected ~1,080 (the exact count tracks the current Overture release)</div>
   </footer>
 </div>
 
@@ -462,7 +464,14 @@ <h1>Wherobots Jobs from Step Functions</h1>
 const $ = id => document.getElementById(id);
 let armedTeardown = false;
 
-function pill(cls, text) { return `<span class="pill ${cls}">${text}</span>`; }
+// Every server-sourced value is HTML-escaped before interpolation into
+// innerHTML. The success callback's output comes from the public relay, so
+// without this, {"x":"<img src=x onerror=...>"} in a job's callback would
+// execute in this page — which can call deploy/teardown.
+const esc = v => String(v ?? "").replace(/[&<>"']/g,
+  c => ({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"}[c]));
+
+function pill(cls, text) { return `<span class="pill ${cls}">${esc(text)}</span>`; }
 
 // Gating greys only the section's action button; the section itself stays
 // readable. The disabled button's tooltip names what is blocking it.
@@ -489,7 +498,7 @@ <h1>Wherobots Jobs from Step Functions</h1>
     <tr><td>WHEROBOTS_API_KEY</td><td>${pill(p.WHEROBOTS_API_KEY ? "ok" : "crit", p.WHEROBOTS_API_KEY ? "set (" + p.WHEROBOTS_API_KEY + ")" : "missing")}</td></tr>
     <tr><td>AWS credentials</td><td>${pill("info", p.aws_credentials)}</td></tr>
     <tr><td>Upload target</td><td>${pill("info", p.storage_target)}</td></tr>
-    <tr><td>Uploaded script</td><td>${p.uploaded ? pill("ok", "yes") + ` <span style="color:var(--ink-mute)">${p.uploaded}</span>` : pill("warn", "not yet")}</td></tr>
+    <tr><td>Uploaded script</td><td>${p.uploaded ? pill("ok", "yes") + ` <span style="color:var(--ink-mute)">${esc(p.uploaded)}</span>` : pill("warn", "not yet")}</td></tr>
     <tr><td>Infrastructure</td><td>${p.deployed ? pill("ok", "deployed") : pill("warn", "not yet")}</td></tr>`;
   $("prov-region").textContent = p.AWS_REGION;
   $("prov-target").textContent = p.storage_target;
@@ -498,33 +507,66 @@ <h1>Wherobots Jobs from Step Functions</h1>
 
   const ready = p.env_file && p.WHEROBOTS_API_KEY;
   setLocked("card-upload", !ready);
-  if (p.uploaded) { markDone("card-upload"); $("upload-status").innerHTML = `<b class="ok">✓ uploaded:</b> ${p.uploaded}`; }
+  if (p.uploaded) { markDone("card-upload"); $("upload-status").innerHTML = `<b class="ok">✓ uploaded:</b> ${esc(p.uploaded)}`; }
   setLocked("card-deploy", !p.uploaded);
   if (p.deployed) { markDone("card-deploy"); $("deploy-status").innerHTML = `<b class="ok">✓ deployed</b>`; }
   setLocked("card-run", !p.deployed);
   setLocked("card-teardown", !p.deployed);
 }
 
-// ── lifecycle scripts over SSE ───────────────────────────────────────────────
-function runScript(name, btnId, termId, statusId, doneMsg) {
+// ── lifecycle scripts, streamed over a POST ──────────────────────────────────
+// POST + JSON (not GET/EventSource): running a lifecycle script changes
+// state, and a GET was triggerable cross-origin by a plain <img> tag. The
+// response body is still SSE-format lines; this parses them from the fetch
+// stream.
+async function runScript(name, btnId, termId, statusId, doneMsg) {
   const btn = $(btnId), term = $(termId), status = $(statusId);
   btn.disabled = true; term.classList.add("open"); term.textContent = "";
   status.innerHTML = `<span class="spin"></span> running…`;
-  const es = new EventSource(`/api/exec?script=${name}`);
-  es.onmessage = e => {
+  const addLine = text => {
     const line = document.createElement("div");
-    if (e.data.startsWith("▶")) line.className = "cmd";
-    line.textContent = e.data;
+    if (text.startsWith("▶")) line.className = "cmd";
+    line.textContent = text;
     term.appendChild(line); term.scrollTop = term.scrollHeight;
   };
-  es.addEventListener("done", e => {
-    es.close(); btn.disabled = false;
-    const code = JSON.parse(e.data).exit_code;
+  const finish = code => {
+    btn.disabled = false;
     status.innerHTML = code === 0 ? `<b class="ok">✓ ${doneMsg}</b>`
-      : `<b class="err">✗ exited with code ${code} — see the streamed output below</b>`;
+      : `<b class="err">✗ exited with code ${esc(code)} — see the streamed output below</b>`;
     preflight();
-  });
-  es.onerror = () => { es.close(); btn.disabled = false; status.innerHTML = `<b class="err">✗ connection lost</b>`; };
+  };
+  try {
+    const resp = await fetch("/api/exec", {
+      method: "POST", headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ script: name }),
+    });
+    if (!resp.ok || !resp.body) {
+      const err = await resp.json().catch(() => ({}));
+      btn.disabled = false;
+      status.innerHTML = `<b class="err">✗ ${esc(err.error || `HTTP ${resp.status}`)}</b>`;
+      return;
+    }
+    const reader = resp.body.pipeThrough(new TextDecoderStream()).getReader();
+    let buf = "", exitCode = null;
+    for (;;) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buf += value;
+      let idx;
+      while ((idx = buf.indexOf("\n\n")) >= 0) {       // one SSE event per blank line
+        const block = buf.slice(0, idx); buf = buf.slice(idx + 2);
+        const isDone = /^event: done$/m.test(block);
+        const data = block.split("\n").filter(l => l.startsWith("data: "))
+          .map(l => l.slice(6)).join("\n");
+        if (isDone) exitCode = JSON.parse(data).exit_code;
+        else addLine(data);
+      }
+    }
+    finish(exitCode ?? 1);
+  } catch (e) {
+    btn.disabled = false;
+    status.innerHTML = `<b class="err">✗ connection lost</b>`;
+  }
 }
 $("btn-upload").onclick = () => runScript("upload", "btn-upload", "term-upload", "upload-status", "uploaded");
 $("btn-deploy").onclick = () => runScript("deploy", "btn-deploy", "term-deploy", "deploy-status", "infrastructure ready — green to run");
@@ -558,7 +600,8 @@ <h1>Wherobots Jobs from Step Functions</h1>
 const MODE_NOTES = {
   normal: `<span class="lbl">What a normal run shows</span>
      The job counts Overture buildings, then posts a <b>success callback</b> — the paused state
-     wakes instantly and NextStep receives <code>{"building_count": 1084}</code>. The fallback
+     wakes instantly and NextStep receives <code>{"building_count": 1080}</code> (the exact
+     count tracks the current Overture release). The fallback
      stages never run: the timeline stays one teal group ending in green, and that absence is
      the point. Typically 1–3 minutes end to end — the slowest job start observed in testing was 52 s.`,
   soft: `<span class="lbl">What the soft-failure test shows</span>
@@ -586,10 +629,10 @@ <h1>Wherobots Jobs from Step Functions</h1>
     body: JSON.stringify({ force_fail: mode === "soft", hard_fail: mode === "hard" }),
   });
   const r = await resp.json();
-  if (r.error) { $("run-status").innerHTML = `<b class="err">✗ ${r.error}</b>`; $("btn-run").disabled = false; return; }
+  if (r.error) { $("run-status").innerHTML = `<b class="err">✗ ${esc(r.error)}</b>`; $("btn-run").disabled = false; return; }
   $("graph-card").style.display = "block";
   $("gantt-card").style.display = "block";
-  $("run-meta").innerHTML = `job ${r.job_name} · <a href="${r.console_url}" target="_blank">AWS console</a>` +
+  $("run-meta").innerHTML = `job ${esc(r.job_name)} · <a href="${esc(r.console_url)}" target="_blank" rel="noopener">AWS console</a>` +
     ` · <a href="https://cloud.wherobots.com/workloads" target="_blank">Wherobots Workload History</a>`;
   $("run-status").innerHTML = `<span class="spin"></span> running…`;
   lastAutoStage = null;
@@ -713,7 +756,7 @@ <h1>Wherobots Jobs from Step Functions</h1>
 
 async function poll(arn) {
   const d = await (await fetch(`/api/execution?arn=${encodeURIComponent(arn)}`)).json();
-  if (d.error) { $("run-status").innerHTML = `<b class="err">poll error: ${d.error}</b>`; return; }
+  if (d.error) { $("run-status").innerHTML = `<b class="err">poll error: ${esc(d.error)}</b>`; return; }
   updateGraph(d);
   renderTimeline(d);
   syncLiveFile(d.stages);
@@ -722,15 +765,15 @@ <h1>Wherobots Jobs from Step Functions</h1>
   if (d.run_id || d.poller) {
     wb.style.display = "block";
     const p = d.poller || {};
-    wb.innerHTML = `<span class="lbl">Fallback engaged</span>Wherobots run <code>${d.run_id || "…"}</code>` +
-      ` · status <b>${p.wherobots_status || "…"}</b> · poller checks so far: ${p.checks ?? 0}`;
+    wb.innerHTML = `<span class="lbl">Fallback engaged</span>Wherobots run <code>${esc(d.run_id || "…")}</code>` +
+      ` · status <b>${esc(p.wherobots_status || "…")}</b> · poller checks so far: ${esc(p.checks ?? 0)}`;
   }
   const terminal = ["SUCCEEDED", "FAILED", "TIMED_OUT", "ABORTED"].includes(d.status);
   if (terminal) {
     clearInterval(pollTimer); $("btn-run").disabled = false;
     document.querySelectorAll("#card-run ol.files li").forEach(li => li.classList.remove("live"));
     $("run-status").innerHTML = d.status === "SUCCEEDED"
-      ? `<b class="ok">✓ pipeline SUCCEEDED — NextStep received: </b><code>${JSON.stringify(d.output && d.output.callback || d.output)}</code>`
+      ? `<b class="ok">✓ pipeline SUCCEEDED — NextStep received: </b><code>${esc(JSON.stringify(d.output && d.output.callback || d.output))}</code>`
       : `<b class="err">✗ pipeline ${d.status} — open the AWS console link for the cause (the job's traceback on a failure callback)</b>`;
   }
 }
diff --git a/aws-step-functions-python-sdk/dashboard/server.py b/aws-step-functions-python-sdk/dashboard/server.py
index bb888c8..5572569 100755
--- a/aws-step-functions-python-sdk/dashboard/server.py
+++ b/aws-step-functions-python-sdk/dashboard/server.py
@@ -6,11 +6,13 @@
 into subprocess environments on this machine — the browser never sees them
 (preflight returns masked values only).
 
-Endpoints:
+Endpoints (all gated on a loopback Host and a same-origin Origin header;
+state-changing ones are POST + application/json so no cross-origin page
+can fire them — see ALLOWED_HOSTS below):
   GET  /                      -> index.html
   GET  /api/preflight         -> .env / .state.json readiness report (masked)
-  GET  /api/exec?script=NAME  -> Server-Sent Events stream of a lifecycle
-                                 script's output (upload | deploy | teardown)
+  POST /api/exec {script}     -> SSE-format stream of a lifecycle script's
+                                 output (upload | deploy | teardown)
   POST /api/start             -> start a pipeline execution, returns its ARN
   GET  /api/execution?arn=ARN -> live digest: parent stage statuses, child
                                  poller progress, Wherobots run_id + status
@@ -32,6 +34,17 @@
 ROOT = Path(__file__).resolve().parent.parent
 PORT = 8321
 
+# Cross-origin defense: the browser happily sends requests to 127.0.0.1 from
+# any website it is showing, so binding to loopback is not an access check.
+# Every request must carry a loopback Host (stops DNS rebinding, where an
+# attacker's domain resolves to 127.0.0.1 so their page can READ responses),
+# and any Origin header must be this dashboard itself (stops cross-site
+# writes). State-changing endpoints are POST + application/json only, which
+# no cross-origin page can send without a CORS preflight this server never
+# answers.
+ALLOWED_HOSTS = {f"127.0.0.1:{PORT}", f"localhost:{PORT}", "127.0.0.1", "localhost"}
+ALLOWED_ORIGINS = {f"http://127.0.0.1:{PORT}", f"http://localhost:{PORT}"}
+
 SCRIPTS = {
     "upload": ["python3", "scripts/01_upload_job.py"],
     "deploy": ["bash", "scripts/02_deploy.sh"],
@@ -221,7 +234,41 @@ def send_json(self, obj, code=200):
         self.end_headers()
         self.wfile.write(body)
 
+    def request_allowed(self):
+        """Host + Origin gate — see ALLOWED_HOSTS above. 403s and returns False
+        on any cross-origin or rebound request."""
+        host = (self.headers.get("Host") or "").strip()
+        if host not in ALLOWED_HOSTS:
+            self.send_json({"error": "forbidden: bad Host"}, 403)
+            return False
+        origin = self.headers.get("Origin")
+        if origin and origin not in ALLOWED_ORIGINS:
+            self.send_json({"error": "forbidden: cross-origin request"}, 403)
+            return False
+        return True
+
+    def json_body(self):
+        """Parse a POST body into a dict; None means a 4xx response was already
+        sent. Non-object JSON (null, arrays, strings) is rejected here so None
+        can never be a legitimate parse result left without a response."""
+        ctype = (self.headers.get("Content-Type") or "").split(";")[0].strip().lower()
+        if ctype != "application/json":
+            self.send_json({"error": "Content-Type must be application/json"}, 415)
+            return None
+        try:
+            length = int(self.headers.get("Content-Length") or 0)
+            parsed = json.loads(self.rfile.read(length) or b"{}") if length else {}
+        except ValueError:
+            self.send_json({"error": "invalid JSON body"}, 400)
+            return None
+        if not isinstance(parsed, dict):
+            self.send_json({"error": "JSON body must be an object"}, 400)
+            return None
+        return parsed
+
     def do_GET(self):
+        if not self.request_allowed():
+            return
         url = urlparse(self.path)
         if url.path in ("/", "/index.html"):
             body = (ROOT / "dashboard" / "index.html").read_bytes()
@@ -232,8 +279,6 @@ def do_GET(self):
             self.wfile.write(body)
         elif url.path == "/api/preflight":
             self.handle_preflight()
-        elif url.path == "/api/exec":
-            self.handle_exec(parse_qs(url.query).get("script", [""])[0])
         elif url.path == "/api/source":
             rel = parse_qs(url.query).get("file", [""])[0]
             if rel not in VIEWABLE:
@@ -254,8 +299,19 @@ def do_GET(self):
             self.send_json({"error": "not found"}, 404)
 
     def do_POST(self):
-        if urlparse(self.path).path == "/api/start":
-            self.handle_start()
+        if not self.request_allowed():
+            return
+        path = urlparse(self.path).path
+        if path == "/api/start":
+            body = self.json_body()
+            if body is not None:
+                self.handle_start(body)
+        elif path == "/api/exec":
+            # POST (never GET): a lifecycle script changes state, and a GET
+            # here was triggerable by a plain <img> tag on any website.
+            body = self.json_body()
+            if body is not None:
+                self.handle_exec(str(body.get("script", "")))
         else:
             self.send_json({"error": "not found"}, 404)
 
@@ -319,15 +375,10 @@ def sse(self, data, event=None):
         self.wfile.write(f"data: {data}\n\n".encode())
         self.wfile.flush()
 
-    def handle_start(self):
+    def handle_start(self, body):
         env, state = load_env(), load_state()
         if not state.get("pipeline_arn") or not state.get("script_uri"):
             return self.send_json({"error": "upload + deploy must finish first"}, 400)
-        try:
-            length = int(self.headers.get("Content-Length") or 0)
-            body = json.loads(self.rfile.read(length) or b"{}") if length else {}
-        except ValueError:
-            body = {}
         job_name = "sfn-ref-" + time.strftime("%Y%m%d-%H%M%S")
         exec_input = json.dumps({
             "script": state["script_uri"],
diff --git a/aws-step-functions-python-sdk/lambdas/callback_relay/handler.py b/aws-step-functions-python-sdk/lambdas/callback_relay/handler.py
index bef610f..b443f2b 100644
--- a/aws-step-functions-python-sdk/lambdas/callback_relay/handler.py
+++ b/aws-step-functions-python-sdk/lambdas/callback_relay/handler.py
@@ -8,26 +8,46 @@
   {"task_token": "...", "action": "failure",   "error": "...", "cause": "..."}
   {"task_token": "...", "action": "heartbeat"}
 
-Auth model (reference-grade): the endpoint (API Gateway HTTP API) is public and
-the unguessable, single-use task token is the capability — a request
-without a live token can do nothing. For production put this behind API
-Gateway with an API key or IAM auth.
+Trust model (reference-grade, documented so you can decide if it fits):
+the endpoint (API Gateway HTTP API) is public, throttled at the stage,
+and the unguessable, single-use task token is the capability — a request
+without a live token can do nothing (Step Functions rejects it). The
+token travels to the job as a plain job argument, so anyone who can read
+that run's arguments in your Wherobots organization (or the Step
+Functions execution history in your AWS account) could post a forged
+callback for that one run; both surfaces are already inside your trust
+boundary. `output` is therefore treated as untrusted downstream: the
+dashboard HTML-escapes it, and this relay caps its size. For production,
+add an authorizer (API key / IAM / WAF) in front of the route.
+
+Anonymous callers get generic errors; details go to CloudWatch logs only.
 """
 
 import base64
 import json
+import logging
 
 import boto3
 
+logger = logging.getLogger()
+logger.setLevel(logging.INFO)
+
 sfn = boto3.client("stepfunctions")
 
+MAX_BODY_BYTES = 262144  # SendTaskSuccess output is capped at 256 KB anyway
+_BAD_REQUEST = {"error": "bad request"}
+
 
 def lambda_handler(event, context):
     try:
         body = event.get("body") or "{}"
-        if event.get("isBase64Encoded"):
-            body = base64.b64decode(body).decode()
-        req = json.loads(body)
+        # Enforce the cap in BYTES, before any parsing: len() on a decoded
+        # string counts characters, and multibyte UTF-8 would sail under it.
+        raw = base64.b64decode(body) if event.get("isBase64Encoded") else body.encode()
+        if len(raw) > MAX_BODY_BYTES:
+            logger.info("rejected oversize callback body (%d bytes)", len(raw))
+            return _resp(400, _BAD_REQUEST)
+        req = json.loads(raw)
         token = req["task_token"]
         action = req.get("action", "heartbeat")
 
@@ -42,10 +62,14 @@ def lambda_handler(event, context):
         elif action == "heartbeat":
             sfn.send_task_heartbeat(taskToken=token)
         else:
-            return _resp(400, {"error": f"unknown action '{action}'"})
+            logger.info("rejected unknown action %r", action)
+            return _resp(400, _BAD_REQUEST)
         return _resp(200, {"ok": True, "action": action})
-    except Exception as exc:  # invalid/expired token, malformed body, ...
-        return _resp(400, {"error": str(exc)})
+    except Exception:
+        # Invalid/expired token, malformed body, boto errors: log the detail,
+        # hand the anonymous caller nothing to learn from.
+        logger.exception("callback relay rejected a request")
+        return _resp(400, _BAD_REQUEST)
 
 
 def _resp(code, obj):
diff --git a/aws-step-functions-python-sdk/lambdas/check_status/handler.py b/aws-step-functions-python-sdk/lambdas/check_status/handler.py
index 0356837..c1680c8 100644
--- a/aws-step-functions-python-sdk/lambdas/check_status/handler.py
+++ b/aws-step-functions-python-sdk/lambdas/check_status/handler.py
@@ -13,17 +13,16 @@
 """
 
 import os
-import subprocess
-import sys
 
-SDK_DIR = "/tmp/sdk"
-if not os.path.exists(SDK_DIR):
-    subprocess.check_call(
-        [sys.executable, "-m", "pip", "install", "wherobots-python-sdk", "--target", SDK_DIR]
-    )
-sys.path.insert(0, SDK_DIR)
+import boto3
 
-from wherobots import WherobotsJob  # noqa: E402
+# API key from Secrets Manager at cold start — never in the function config.
+if "WHEROBOTS_API_KEY" not in os.environ:
+    os.environ["WHEROBOTS_API_KEY"] = boto3.client("secretsmanager").get_secret_value(
+        SecretId=os.environ["WHEROBOTS_API_KEY_SECRET_ARN"]
+    )["SecretString"]
+
+from wherobots import WherobotsJob  # noqa: E402  (vendored into the zip at deploy time)
 
 
 def lambda_handler(event, context):
diff --git a/aws-step-functions-python-sdk/lambdas/find_run/handler.py b/aws-step-functions-python-sdk/lambdas/find_run/handler.py
index 0bdca8e..41663a2 100644
--- a/aws-step-functions-python-sdk/lambdas/find_run/handler.py
+++ b/aws-step-functions-python-sdk/lambdas/find_run/handler.py
@@ -12,17 +12,16 @@
 """
 
 import os
-import subprocess
-import sys
 
-SDK_DIR = "/tmp/sdk"
-if not os.path.exists(SDK_DIR):
-    subprocess.check_call(
-        [sys.executable, "-m", "pip", "install", "wherobots-python-sdk", "--target", SDK_DIR]
-    )
-sys.path.insert(0, SDK_DIR)
+import boto3
 
-from wherobots import WherobotsJob  # noqa: E402
+# API key from Secrets Manager at cold start — never in the function config.
+if "WHEROBOTS_API_KEY" not in os.environ:
+    os.environ["WHEROBOTS_API_KEY"] = boto3.client("secretsmanager").get_secret_value(
+        SecretId=os.environ["WHEROBOTS_API_KEY_SECRET_ARN"]
+    )["SecretString"]
+
+from wherobots import WherobotsJob  # noqa: E402  (vendored into the zip at deploy time)
 
 
 def lambda_handler(event, context):
diff --git a/aws-step-functions-python-sdk/lambdas/submit/handler.py b/aws-step-functions-python-sdk/lambdas/submit/handler.py
index 0029183..bf5a045 100644
--- a/aws-step-functions-python-sdk/lambdas/submit/handler.py
+++ b/aws-step-functions-python-sdk/lambdas/submit/handler.py
@@ -1,8 +1,8 @@
 """Submit a Wherobots job run and return immediately with the run_id.
 
-Installs wherobots-python-sdk from PyPI into /tmp on cold start so the
-deployment needs no layers or containers (reference pattern — bake a
-Lambda layer for production).
+The SDK is vendored into the deployment zip at deploy time (pinned in
+requirements.txt), so cold starts run no network installs and every
+instance runs the same code.
 
 The event is the output of the previous Step Functions state:
     {"script": "s3://...", "job_name": "...", "runtime": "tiny"}
@@ -11,15 +11,16 @@
 """
 
 import os
-import subprocess
-import sys
 
-SDK_DIR = "/tmp/sdk"
-if not os.path.exists(SDK_DIR):
-    subprocess.check_call(
-        [sys.executable, "-m", "pip", "install", "wherobots-python-sdk", "--target", SDK_DIR]
-    )
-sys.path.insert(0, SDK_DIR)
+import boto3
+
+# The Wherobots API key lives in Secrets Manager, never in the function's
+# configuration: fetched once per cold start into the process environment,
+# where the SDK reads it. Reading the function config shows only the ARN.
+if "WHEROBOTS_API_KEY" not in os.environ:
+    os.environ["WHEROBOTS_API_KEY"] = boto3.client("secretsmanager").get_secret_value(
+        SecretId=os.environ["WHEROBOTS_API_KEY_SECRET_ARN"]
+    )["SecretString"]
 
 from wherobots import WherobotsJob  # noqa: E402
 
@@ -45,7 +46,8 @@ def lambda_handler(event, context):
         runtime=data.get("runtime", "tiny"),
         region=os.environ.get("WHEROBOTS_REGION", "aws-us-west-2"),
         args=args,
-        # api_key is read from the WHEROBOTS_API_KEY env var on this function
+        # api_key: the SDK reads WHEROBOTS_API_KEY from the process env,
+        # populated above from Secrets Manager
     ) as job:
         run_id = job.submit()  # returns in seconds
 
diff --git a/aws-step-functions-python-sdk/requirements.txt b/aws-step-functions-python-sdk/requirements.txt
index 6092bac..dde800a 100644
--- a/aws-step-functions-python-sdk/requirements.txt
+++ b/aws-step-functions-python-sdk/requirements.txt
@@ -1,4 +1,4 @@
-# Local requirements: only the upload step (scripts/01_upload_job.py) needs this.
-# The Lambdas install the SDK themselves from PyPI at cold start, and the
-# dashboard server is Python stdlib only.
-wherobots-python-sdk
+# Pinned: this exact version is what the upload step runs locally AND what
+# 02_deploy.sh vendors into the submit/check-status/find-run Lambda zips —
+# no network installs at Lambda cold start, every instance runs the same code.
+wherobots-python-sdk==0.4.0
diff --git a/aws-step-functions-python-sdk/scripts/02_deploy.sh b/aws-step-functions-python-sdk/scripts/02_deploy.sh
index 8ffa2da..23f02a7 100755
--- a/aws-step-functions-python-sdk/scripts/02_deploy.sh
+++ b/aws-step-functions-python-sdk/scripts/02_deploy.sh
@@ -2,10 +2,14 @@
 # Step 2 — build the AWS infrastructure with plain AWS CLI calls.
 #
 # Creates (all names start with $RESOURCE_PREFIX):
-#   1 IAM role for the Lambdas          (basic execution + SendTask* so the
-#                                        callback relay can complete tasks)
+#   1 Secrets Manager secret            (the Wherobots API key — the Lambdas
+#                                        read it at cold start; it is never
+#                                        stored in a function's configuration)
+#   1 IAM role for the Lambdas          (basic execution + GetSecretValue on
+#                                        that one secret)
+#   1 IAM role for the callback relay   (basic execution + SendTask*)
 #   4 Lambda functions                  (submit, check-status, callback-relay
-#                                        + its public Function URL, find-run)
+#                                        behind an API Gateway HTTP API, find-run)
 #   1 IAM role for the state machines   (invoke the Lambdas + start the child
 #                                        poller execution + the EventBridge
 #                                        rule the .sync pattern requires)
@@ -51,16 +55,64 @@ TAG_PROJECT="aws-step-functions-python-sdk"
 TAG_CREATED_AT="$(date -u +%Y-%m-%d)"
 TAG_TEARDOWN_BY="$(python3 -c 'import datetime as d; print((d.date.today() + d.timedelta(days=30)).isoformat())')"
 # Same four tags, in each service's own CLI syntax
-IAM_TAGS=(Key=ManagedBy,Value=claude-code Key=Project,Value="$TAG_PROJECT" Key=CreatedAt,Value="$TAG_CREATED_AT" Key=TeardownBy,Value="$TAG_TEARDOWN_BY")
-LAMBDA_TAGS="ManagedBy=claude-code,Project=${TAG_PROJECT},CreatedAt=${TAG_CREATED_AT},TeardownBy=${TAG_TEARDOWN_BY}"
-SFN_TAGS=(key=ManagedBy,value=claude-code key=Project,value="$TAG_PROJECT" key=CreatedAt,value="$TAG_CREATED_AT" key=TeardownBy,value="$TAG_TEARDOWN_BY")
+IAM_TAGS=(Key=ManagedBy,Value=wherobots-labs Key=Project,Value="$TAG_PROJECT" Key=CreatedAt,Value="$TAG_CREATED_AT" Key=TeardownBy,Value="$TAG_TEARDOWN_BY")
+LAMBDA_TAGS="ManagedBy=wherobots-labs,Project=${TAG_PROJECT},CreatedAt=${TAG_CREATED_AT},TeardownBy=${TAG_TEARDOWN_BY}"
+SFN_TAGS=(key=ManagedBy,value=wherobots-labs key=Project,value="$TAG_PROJECT" key=CreatedAt,value="$TAG_CREATED_AT" key=TeardownBy,value="$TAG_TEARDOWN_BY")
 
 echo "── Who am I ──────────────────────────────────────────────────────────"
 run aws sts get-caller-identity --query Account --output text
 ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
 
 echo
-echo "── 1/5 IAM role for the Lambdas ──────────────────────────────────────"
+echo "── 1/6 Secrets Manager: the Wherobots API key ────────────────────────"
+# The key lives in Secrets Manager, not in Lambda environment variables:
+# anyone with lambda:GetFunctionConfiguration could read a plain env var,
+# while the secret needs secretsmanager:GetSecretValue on this one ARN.
+SECRET_NAME="${RESOURCE_PREFIX}-wherobots-api-key"
+create_secret() {
+  echo "▶ aws secretsmanager create-secret --name $SECRET_NAME (secret hidden)"
+  SECRET_ARN=$(aws secretsmanager create-secret --name "$SECRET_NAME" \
+    --description "Wherobots API key for the ${RESOURCE_PREFIX} reference pipeline" \
+    --secret-string "$WHEROBOTS_API_KEY" \
+    --tags "${IAM_TAGS[@]}" \
+    --query ARN --output text)
+}
+put_secret() {
+  echo "▶ aws secretsmanager put-secret-value --secret-id $SECRET_NAME (secret hidden)"
+  aws secretsmanager put-secret-value --secret-id "$SECRET_NAME" \
+    --secret-string "$WHEROBOTS_API_KEY" --query VersionId --output text
+}
+# Three possible states: live (update in place), absent (create), or pending
+# deletion. A soft-deleted secret restores; teardown's force-delete cannot be
+# restored, so wait for the asynchronous deletion to finish and create fresh.
+DELETED_AT=$(aws secretsmanager describe-secret --secret-id "$SECRET_NAME" \
+  --query DeletedDate --output text 2>/dev/null || echo "ABSENT")
+if [ "$DELETED_AT" = "ABSENT" ]; then
+  create_secret
+elif [ "$DELETED_AT" = "None" ]; then
+  SECRET_ARN=$(aws secretsmanager describe-secret --secret-id "$SECRET_NAME" --query ARN --output text)
+  put_secret
+elif quiet aws secretsmanager restore-secret --secret-id "$SECRET_NAME"; then
+  SECRET_ARN=$(aws secretsmanager describe-secret --secret-id "$SECRET_NAME" --query ARN --output text)
+  put_secret
+else
+  echo "secret $SECRET_NAME is mid force-delete — waiting for Secrets Manager to finish ..."
+  for attempt in $(seq 1 24); do
+    if ! quiet aws secretsmanager describe-secret --secret-id "$SECRET_NAME"; then
+      break
+    fi
+    sleep 5
+  done
+  if quiet aws secretsmanager describe-secret --secret-id "$SECRET_NAME"; then
+    echo "✗ secret $SECRET_NAME is still pending deletion after 2 minutes — retry the deploy shortly" >&2
+    exit 1
+  fi
+  create_secret
+fi
+echo "secret: $SECRET_ARN"
+
+echo
+echo "── 2/6 IAM role for the Lambdas ──────────────────────────────────────"
 TRUST_LAMBDA='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
 if quiet aws iam get-role --role-name "$LAMBDA_ROLE"; then
   echo "role $LAMBDA_ROLE already exists — skipping create"
@@ -73,24 +125,67 @@ else
 fi
 run aws iam attach-role-policy --role-name "$LAMBDA_ROLE" \
   --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+# Read access to exactly one secret — the API key the SDK Lambdas fetch at
+# cold start. No other secret in the account is readable through this role.
+SECRET_POLICY=$(cat <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": "secretsmanager:GetSecretValue",
+    "Resource": "${SECRET_ARN}"
+  }]
+}
+EOF
+)
+run aws iam put-role-policy --role-name "$LAMBDA_ROLE" \
+  --policy-name "${RESOURCE_PREFIX}-secret-policy" \
+  --policy-document "$SECRET_POLICY"
+# Upgrade path: earlier versions attached SendTask* to this shared role before
+# the relay got its own. Remove the legacy policy so a redeploy over an old
+# stack actually sheds the excess permission (no-op on a fresh account).
+if quiet aws iam get-role-policy --role-name "$LAMBDA_ROLE" \
+    --policy-name "${RESOURCE_PREFIX}-sendtask-policy"; then
+  run aws iam delete-role-policy --role-name "$LAMBDA_ROLE" \
+    --policy-name "${RESOURCE_PREFIX}-sendtask-policy"
+fi
 LAMBDA_ROLE_ARN="arn:aws:iam::${ACCOUNT_ID}:role/${LAMBDA_ROLE}"
 
 echo
-echo "── 2/5 Package the Lambda handlers ───────────────────────────────────"
-run zip -j -q lambdas/submit.zip lambdas/submit/handler.py
-run zip -j -q lambdas/check_status.zip lambdas/check_status/handler.py
+echo "── 3/6 Package the Lambda handlers ───────────────────────────────────"
+# The SDK Lambdas get the pinned wherobots-python-sdk vendored into their
+# zips: no network install at cold start, reproducible code on every
+# instance. The relay needs only boto3, which the Lambda runtime provides.
+BUILD_DIR="lambdas/.build"
+rm -rf "$BUILD_DIR"
+echo
+echo "▶ pip install -r requirements.txt --target $BUILD_DIR (vendoring the pinned SDK)"
+python3 -m pip install --quiet --disable-pip-version-check \
+  -r requirements.txt --target "$BUILD_DIR" \
+  --platform manylinux2014_x86_64 --python-version 3.12 --only-binary=:all: \
+  || python3 -m pip install --quiet --disable-pip-version-check \
+       -r requirements.txt --target "$BUILD_DIR"
+package_fn() { # zipfile handler-file
+  local zipfile=$1 handler=$2
+  rm -f "$zipfile"
+  (cd "$BUILD_DIR" && zip -r -q "../../$zipfile" . -x '*.pyc' -x '*__pycache__*')
+  zip -j -q "$zipfile" "$handler"
+}
+run package_fn lambdas/submit.zip lambdas/submit/handler.py
+run package_fn lambdas/check_status.zip lambdas/check_status/handler.py
+run package_fn lambdas/find_run.zip lambdas/find_run/handler.py
 run zip -j -q lambdas/callback_relay.zip lambdas/callback_relay/handler.py
-run zip -j -q lambdas/find_run.zip lambdas/find_run/handler.py
 
 echo
-echo "── 3/5 Lambda functions ──────────────────────────────────────────────"
-# Environment maps are built as JSON so a secret containing '=' or ',' can
-# never reshape the CLI's shorthand-map parsing.
+echo "── 4/6 Lambda functions ──────────────────────────────────────────────"
+# Environment maps are built as JSON so a value containing '=' or ',' can
+# never reshape the CLI's shorthand-map parsing. The API key itself is NOT
+# here — only the ARN of the secret holding it.
 lambda_env_json() { # [extra_key extra_value]...
   python3 - "$@" <<'PY'
 import json, os, sys
 variables = {
-    "WHEROBOTS_API_KEY": os.environ["WHEROBOTS_API_KEY"],
+    "WHEROBOTS_API_KEY_SECRET_ARN": os.environ["SECRET_ARN"],
     "WHEROBOTS_REGION": os.environ.get("WHEROBOTS_REGION", "aws-us-west-2"),
 }
 extra = sys.argv[1:]
@@ -98,6 +193,7 @@ variables.update(dict(zip(extra[::2], extra[1::2])))
 print(json.dumps({"Variables": variables}))
 PY
 }
+export SECRET_ARN
 LAMBDA_ENV="$(lambda_env_json)"
 
 deploy_fn() { # name zipfile timeout memory [env] [role_arn]
@@ -179,17 +275,17 @@ deploy_fn "$RELAY_FN" lambdas/callback_relay.zip 30 256 '{"Variables":{"NOOP":"1
 echo
 echo "── API Gateway HTTP API for the callback relay ───────────────────────"
 # The relay is fronted by an API Gateway HTTP API rather than a Lambda
-# Function URL: many orgs (this one included) block anonymous
-# lambda:InvokeFunctionUrl via SCP, and API Gateway is the sanctioned way
-# to expose a public HTTPS endpoint. The unguessable single-use task token
-# remains the capability; production hardening adds an API key or WAF.
+# Function URL: many orgs block anonymous lambda:InvokeFunctionUrl via SCP,
+# and API Gateway is the widely-sanctioned way to expose a public HTTPS
+# endpoint. The unguessable single-use task token remains the capability;
+# production hardening adds an API key or WAF.
 RELAY_ARN="arn:aws:lambda:${AWS_REGION}:${ACCOUNT_ID}:function:${RELAY_FN}"
 API_NAME="${RESOURCE_PREFIX}-callback"
 API_ID=$(aws apigatewayv2 get-apis --query "Items[?Name=='${API_NAME}'].ApiId | [0]" --output text)
 if [ "$API_ID" = "None" ] || [ -z "$API_ID" ]; then
   run aws apigatewayv2 create-api --name "$API_NAME" --protocol-type HTTP \
     --target "$RELAY_ARN" \
-    --tags "ManagedBy=claude-code,Project=${TAG_PROJECT},CreatedAt=${TAG_CREATED_AT},TeardownBy=${TAG_TEARDOWN_BY}" \
+    --tags "ManagedBy=wherobots-labs,Project=${TAG_PROJECT},CreatedAt=${TAG_CREATED_AT},TeardownBy=${TAG_TEARDOWN_BY}" \
     --query ApiId --output text
   API_ID=$(aws apigatewayv2 get-apis --query "Items[?Name=='${API_NAME}'].ApiId | [0]" --output text)
 fi
@@ -208,6 +304,10 @@ if ! PERM_OUT=$(aws lambda add-permission --function-name "$RELAY_FN" \
     exit 1
   fi
 fi
+# Stage throttle: without it the only cap is the account-level API Gateway
+# limit, so anyone could flood the public endpoint and run up Lambda cost.
+run aws apigatewayv2 update-stage --api-id "$API_ID" --stage-name '$default' \
+  --default-route-settings '{"ThrottlingBurstLimit":10,"ThrottlingRateLimit":5}'
 CALLBACK_URL="https://${API_ID}.execute-api.${AWS_REGION}.amazonaws.com/"
 echo "callback URL: $CALLBACK_URL"
 
@@ -224,7 +324,7 @@ CHECK_ARN="arn:aws:lambda:${AWS_REGION}:${ACCOUNT_ID}:function:${CHECK_FN}"
 FIND_ARN="arn:aws:lambda:${AWS_REGION}:${ACCOUNT_ID}:function:${FIND_FN}"
 
 echo
-echo "── 4/5 IAM role for the state machines ───────────────────────────────"
+echo "── 5/6 IAM role for the state machines ───────────────────────────────"
 TRUST_SFN='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"states.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
 if quiet aws iam get-role --role-name "$SFN_ROLE"; then
   echo "role $SFN_ROLE already exists — skipping create"
@@ -269,7 +369,7 @@ run aws iam put-role-policy --role-name "$SFN_ROLE" \
 SFN_ROLE_ARN="arn:aws:iam::${ACCOUNT_ID}:role/${SFN_ROLE}"
 
 echo
-echo "── 5/5 Step Functions state machines ─────────────────────────────────"
+echo "── 6/6 Step Functions state machines ─────────────────────────────────"
 render() { # asl-file  (substitutes the ${...} placeholders)
   sed -e "s|\${CHECK_LAMBDA_ARN}|${CHECK_ARN}|" \
       -e "s|\${SUBMIT_LAMBDA_ARN}|${SUBMIT_ARN}|" \
diff --git a/aws-step-functions-python-sdk/scripts/99_teardown.sh b/aws-step-functions-python-sdk/scripts/99_teardown.sh
index c829c1e..4a76694 100755
--- a/aws-step-functions-python-sdk/scripts/99_teardown.sh
+++ b/aws-step-functions-python-sdk/scripts/99_teardown.sh
@@ -62,6 +62,9 @@ done
 
 echo
 echo "── IAM roles ──────────────────────────────────────────────────────────"
+run aws iam delete-role-policy --role-name "${RESOURCE_PREFIX}-lambda-role" \
+  --policy-name "${RESOURCE_PREFIX}-secret-policy"
+# Legacy policy from pre-relay-role versions; "already gone" on current stacks.
 run aws iam delete-role-policy --role-name "${RESOURCE_PREFIX}-lambda-role" \
   --policy-name "${RESOURCE_PREFIX}-sendtask-policy"
 run aws iam detach-role-policy --role-name "${RESOURCE_PREFIX}-lambda-role" \
@@ -76,6 +79,12 @@ run aws iam delete-role-policy --role-name "${RESOURCE_PREFIX}-sfn-role" \
   --policy-name "${RESOURCE_PREFIX}-sfn-policy"
 run aws iam delete-role --role-name "${RESOURCE_PREFIX}-sfn-role"
 
+echo
+echo "── Secrets Manager ────────────────────────────────────────────────────"
+run aws secretsmanager delete-secret \
+  --secret-id "${RESOURCE_PREFIX}-wherobots-api-key" \
+  --force-delete-without-recovery --query Name --output text
+
 if [ "$FAILED" -ne 0 ]; then
   echo
   echo "❌ Teardown INCOMPLETE — one or more delete calls failed (see above)."
@@ -85,7 +94,7 @@ fi
 
 echo
 echo "── Local state ────────────────────────────────────────────────────────"
-run rm -f .state.json lambdas/*.zip
+run rm -rf .state.json lambdas/*.zip lambdas/.build
 
 echo
 echo "✅ Teardown complete. (The uploaded job script in Wherobots storage is"
diff --git a/aws-step-functions-python-sdk/tests/test_reference.py b/aws-step-functions-python-sdk/tests/test_reference.py
index 4874a9c..e37cdb3 100644
--- a/aws-step-functions-python-sdk/tests/test_reference.py
+++ b/aws-step-functions-python-sdk/tests/test_reference.py
@@ -154,6 +154,99 @@ def test_happy_path_posts_exactly_one_success(self):
         self.assertEqual(self.posts[-1]["output"], {"building_count": 1084})
 
 
+class TestDashboardRequestGate(unittest.TestCase):
+    """Regression tests for the cross-origin hardening: the dashboard must
+    reject spoofed Hosts (DNS rebinding), foreign Origins, and any attempt to
+    run a lifecycle script via GET or a non-JSON POST."""
+
+    @classmethod
+    def setUpClass(cls):
+        import http.server
+        sys.path.insert(0, str(IMPL / "dashboard"))
+        import server as dashboard_server
+        cls.mod = dashboard_server
+        cls.httpd = http.server.ThreadingHTTPServer(
+            ("127.0.0.1", 0), dashboard_server.Handler)
+        cls.port = cls.httpd.server_address[1]
+        import threading
+        threading.Thread(target=cls.httpd.serve_forever, daemon=True).start()
+        # The gate's allowlists are built from the canonical PORT constant;
+        # widen them to this test server's ephemeral port.
+        dashboard_server.ALLOWED_HOSTS.add(f"127.0.0.1:{cls.port}")
+        dashboard_server.ALLOWED_ORIGINS.add(f"http://127.0.0.1:{cls.port}")
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.httpd.shutdown()
+
+    def _request(self, method, path, headers=None, body=None):
+        import http.client
+        conn = http.client.HTTPConnection("127.0.0.1", self.port, timeout=5)
+        conn.request(method, path, body=body, headers=headers or {})
+        resp = conn.getresponse()
+        data = resp.read()
+        conn.close()
+        return resp.status, data
+
+    def test_spoofed_host_is_rejected(self):
+        status, _ = self._request(
+            "GET", "/api/preflight", {"Host": "attacker.example:8321"})
+        self.assertEqual(status, 403)
+
+    def test_foreign_origin_is_rejected(self):
+        status, _ = self._request(
+            "GET", "/api/preflight",
+            {"Host": f"127.0.0.1:{self.port}", "Origin": "https://evil.example"})
+        self.assertEqual(status, 403)
+
+    def test_same_origin_get_is_allowed(self):
+        status, _ = self._request(
+            "GET", "/api/preflight",
+            {"Host": f"127.0.0.1:{self.port}",
+             "Origin": f"http://127.0.0.1:{self.port}"})
+        self.assertEqual(status, 200)
+
+    def test_exec_via_get_is_gone(self):
+        status, _ = self._request(
+            "GET", "/api/exec?script=teardown", {"Host": f"127.0.0.1:{self.port}"})
+        self.assertEqual(status, 404)
+
+    def test_exec_post_requires_json_content_type(self):
+        # A cross-site form/fetch can send text/plain without preflight —
+        # it must be refused.
+        status, _ = self._request(
+            "POST", "/api/exec", {"Host": f"127.0.0.1:{self.port}",
+                                  "Content-Type": "text/plain"},
+            body='{"script":"teardown"}')
+        self.assertEqual(status, 415)
+
+    def test_json_null_body_gets_a_response_not_a_hang(self):
+        # json.loads("null") is None; the handler must still answer with a 400
+        # rather than treating it as already-responded and leaving the client
+        # waiting on an HTTP/1.1 connection.
+        status, _ = self._request(
+            "POST", "/api/exec", {"Host": f"127.0.0.1:{self.port}",
+                                  "Content-Type": "application/json"},
+            body="null")
+        self.assertEqual(status, 400)
+
+    def test_exec_post_unknown_script_is_rejected(self):
+        status, _ = self._request(
+            "POST", "/api/exec", {"Host": f"127.0.0.1:{self.port}",
+                                  "Content-Type": "application/json"},
+            body='{"script":"rm -rf"}')
+        self.assertEqual(status, 400)
+
+
+class TestPinnedRequirements(unittest.TestCase):
+    def test_sdk_version_is_pinned(self):
+        req = (IMPL / "requirements.txt").read_text()
+        for line in req.splitlines():
+            line = line.strip()
+            if line and not line.startswith("#"):
+                self.assertIn("==", line, f"unpinned requirement: {line}")
+
+
 class TestDrainBeforeWait(unittest.TestCase):
     def test_abandoned_reader_does_not_deadlock(self):
         """Regression test for the exec-lock deadlock: a child writing far past