# Security Notes

The application must follow OWASP guidance throughout implementation.

## Required Controls

- Strong password hashing.
- Login rate limiting.
- Backend role and client-scope authorization.
- Restrictive CORS.
- HTTP security headers.
- Parameterized database queries.
- Safe upload handling.
- Protected attachment access.
- Invitation tokens with expiration and single use.
- Audit logs for sensitive changes.
- No secrets in the repository.

## Upload Rules

- Limit file size.
- Restrict MIME types.
- Validate actual file content.
- Rename files before storage.
- Do not execute or directly expose uploaded files.
- Check client access before serving files.