27 lines
681 B
Markdown
27 lines
681 B
Markdown
# Security Notes
|
|
|
|
The application must follow OWASP guidance throughout implementation.
|
|
|
|
## Required Controls
|
|
|
|
- Strong password hashing.
|
|
- Login rate limiting.
|
|
- Backend role and client-scope authorization.
|
|
- Restrictive CORS.
|
|
- HTTP security headers.
|
|
- Parameterized database queries.
|
|
- Safe upload handling.
|
|
- Protected attachment access.
|
|
- Invitation tokens with expiration and single use.
|
|
- Audit logs for sensitive changes.
|
|
- No secrets in the repository.
|
|
|
|
## Upload Rules
|
|
|
|
- Limit file size.
|
|
- Restrict MIME types.
|
|
- Validate actual file content.
|
|
- Rename files before storage.
|
|
- Do not execute or directly expose uploaded files.
|
|
- Check client access before serving files.
|