first commit

docs/security.md

@@ -0,0 +1,26 @@
+# Security Notes
+
+The application must follow OWASP guidance throughout implementation.
+
+## Required Controls
+
+- Strong password hashing.
+- Login rate limiting.
+- Backend role and client-scope authorization.
+- Restrictive CORS.
+- HTTP security headers.
+- Parameterized database queries.
+- Safe upload handling.
+- Protected attachment access.
+- Invitation tokens with expiration and single use.
+- Audit logs for sensitive changes.
+- No secrets in the repository.
+
+## Upload Rules
+
+- Limit file size.
+- Restrict MIME types.
+- Validate actual file content.
+- Rename files before storage.
+- Do not execute or directly expose uploaded files.
+- Check client access before serving files.