# Security Notes

Date: 2026-06-16

Implemented security foundations:

- Password hashing and password policy services.
- Server-side RBAC permission checks.
- CSRF enforcement for non-API POST routes.
- Tenant ownership columns and tenant-scoped repository patterns.
- API token table with `token_hash` for future public API work.
- Audit log table and audit service coverage for sensitive platform, import, export, support, portal, and settings actions.
- Escaped templates and CSV formula neutralisation for exports.
- App-level security headers, CSP, `X-Powered-By` removal, and session cookie policy.
- Demo auto-login gated so production mode with demo disabled does not auto-login.
- LLM provider settings mask secrets and the current assistant does not call external models.
- Deployment-readiness checks for production mode, debug disablement, application secret strength, DB DSN presence, HTTPS URL, secure cookies, proxy policy, public document root, runtime logging, backup/restore evidence, monitoring, rollback proof, and CI release gate.

Known production hardening still required:

- Keep the Gate 3 MySQL tenant-isolation smoke in CI and expand it when new tenant-owned modules are added.
- Public REST API implementation, token auth, rate limiting, and route-level security if the planned API is released.
- Large-file import performance tests and durable import storage/reporting hardening.
- Live OAuth/webhook security for accounting and calendar integrations.
- Live billing provider webhook signatures, idempotency, entitlement enforcement, and payment audit trails.
- Owner-provided hosted infrastructure evidence: real TLS termination, trusted proxy CIDRs, writable production log sink, backup/restore proof, uptime/error monitoring endpoints, CI release-gate evidence, and CSP reporting.