Implemented App Controls
The items below are materially present in the current codebase, compose stack, CI configuration, or user-facing security flows.
JWT cookie auth with revocation, single-session enforcement, issuer/audience/nbf validation, and HttpOnly cookie transport.
Role and ownership checks on protected resources, admin-only routes, and storage access paths.
Argon2id password hashing, account lockout, auth throttling, and reduced account-enumeration signals.
CSRF origin validation for unsafe cookie-authenticated requests plus strict CORS and trusted-host enforcement.
Upload MIME validation, quarantine flow, asynchronous ClamAV scanning, and malicious-file retention handling.
Generic client-safe errors with request correlation IDs and reduced filesystem/tool detail exposure.
Data minimization on file and bug-report APIs so storage paths and raw fingerprints are not exposed to users.
Secure response headers, cache suppression on sensitive auth flows, and hardened reverse-proxy topology.
CI security scanning with bandit, pip-audit, npm audit, semgrep, gitleaks, trivy, and Dependabot updates.