mira/docs/security.md

Security Notes

The application must follow OWASP guidance throughout implementation.

Required Controls

• Strong password hashing.
• Login rate limiting.
• Backend role and client-scope authorization.
• Restrictive CORS.
• HTTP security headers.
• Parameterized database queries.
• Safe upload handling.
• Protected attachment access.
• Invitation tokens with expiration and single use.
• Audit logs for sensitive changes.
• No secrets in the repository.

Upload Rules

• Limit file size.
• Restrict MIME types.
• Validate actual file content.
• Rename files before storage.
• Do not execute or directly expose uploaded files.
• Check client access before serving files.