# Security Baseline

## Implemented controls

- Laravel session authentication with login throttling and session regeneration
- Encrypted, secure, HTTP-only, SameSite=Lax production session cookie
- CSRF protection on all state-changing web actions
- Restrictive Content Security Policy with no inline script allowance, plus frame, MIME, referrer, and browser capability headers
- Password hashing through Laravel's current hashing driver
- No public registration or default production credential
- Per-organization memberships and scoped domain queries
- Fail-closed HTTP tenant scope, including route-model binding under HTTP tests
- Tenant-constrained foreign-key validation for workflow and financial links
- Permission middleware plus controller-level checks for material actions
- Private evidence storage, server-side MIME/size validation, randomized filenames, and SHA-256 checksums
- Optimistic record version checks to prevent silent overwrites
- Auditable material actions
- Invoice overpayment prevention, account/invoice currency matching, and same-currency transfer rules
- Derived account and invoice balances rather than user-entered balances
- Production HTTPS forcing behind trusted WHM proxy headers
- `APP_DEBUG=false` production default

## WHM controls still required

- Point the domain document root only to the Laravel `public` directory.
- Enable PHP 8.4 and all required extensions, especially Fileinfo.
- Protect `.env`; never place it in `public`.
- Use a dedicated MySQL user with rights only to the Atlas database.
- Enable AutoSSL for `wiziv.net` before first login.
- Schedule daily database and application backups and perform a restoration test.
- Run `php artisan optimize` after deployment and after every configuration change.
- Keep Laravel and Composer dependencies patched under a controlled maintenance process.
- Run `composer audit` and the full test suite before each release.
- Enable WHM protections already identified for the server: cPHulk, jailed accounts, and supported kernel/symlink protection.

## Deferred controls before H1 external design partners

- Password reset email flow and optional multi-factor authentication
- Formal access review and account deactivation cadence
- Malware scanning for uploaded files
- Backup/restore evidence and documented RPO/RTO
- Security and privacy review, retention policy, and incident runbooks
- Independent penetration test before any enterprise-readiness claim

## Verification posture

[OWASP ASVS 5.0](https://owasp.org/www-project-application-security-verification-standard/) is the control-review baseline. The application does not claim certification. Before external design partners, map applicable Level 2 requirements to test evidence, with particular attention to authentication, tenant access control, file handling, validation, business logic, logging, data protection, and configuration.