If you discover a security vulnerability, please report it responsibly:

1. Do not open a public issue
2. Email security findings to the maintainers with:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
   • Suggested fix (if any)
3. You will receive an acknowledgment within 48 hours
4. A fix will be developed and released as soon as possible

┌──────────────┐     ┌───────────────┐     ┌──────────────┐
│   Client     │────▶│  JWT Verify   │────▶│ Role Check   │
│  (Bearer /   │     │  (HS256)      │     │ (admin/      │
│   Cookie)    │     │               │     │  auditor/    │
│              │     │               │     │  user)       │
└──────────────┘     └───────────────┘     └──────────────┘
                                                  │
                                           ┌──────▼──────┐
                                           │ Tenant      │
                                           │ Isolation   │
                                           │ (X-Tenant-  │
                                           │  ID header) │
                                           └─────────────┘

• JWT tokens with configurable expiration (default 60 min)
• HttpOnly secure cookies (configurable Secure, SameSite, Domain)
• PBKDF2+SHA256 password hashing
• RBAC with three roles:
  • admin — full access including user/tenant management
  • auditor — read access to documents, approvals, and audit logs
  • user — chat and document preview only

Data isolation is enforced at three layers:

A user can only access tenants they are explicitly assigned to via the user_tenants join table.

• Output policy guard — Configurable regex patterns scan every LLM response for:
  • AWS access keys (AKIA..., ASIA...)
  • API secret keys (sk-..., rk-...)
  • Private keys (RSA, SSH, EC, DSA)
  • Inline credentials (password=...)
• Prompt injection guardrails — System prompts instruct the LLM to refuse data exfiltration attempts
• Human-in-the-loop approval — Answers can be held for human review before release

• Filename sanitization — Uploaded filenames are sanitized to prevent directory traversal
• File extension allowlist — Only configured extensions are accepted (default: pdf, txt, md, png, jpg, jpeg)
• File size limit — Configurable maximum upload size (default: 20MB)
• Document preview path traversal protection — Resolved paths verified against configured storage root
• CSV export formula injection mitigation — Cell values prefixed to prevent Excel formula execution

• Trusted host middleware — Rejects requests from untrusted Host headers
• Security headers — CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
• CORS — Configurable allowed origins
• Non-root Docker container — API runs as unprivileged user
• OPA/Conftest policy gate — Infrastructure-as-code changes validated against security policies
• TLS — HTTPS enforced via ALB in production

• Full audit trail — Every user action is logged with timestamp, user, tenant, action, input, output, and metadata
• Audit log search — Query by action, user, date range
• CSV export — Download audit logs for compliance reporting
• Request ID tracing — Unique request ID propagated across all service calls

• Change APP_JWT_SECRET_KEY from default
• Set APP_COOKIE_SECURE=true
• Set APP_COOKIE_SAMESITE=strict or lax
• Configure APP_CORS_ORIGINS to production domains only
• Configure APP_TRUSTED_HOSTS to production domains only
• Use APP_DEMO_PASSWORD_HASH instead of APP_DEMO_PASSWORD
• Use PostgreSQL instead of SQLite (APP_DATABASE_URL)
• Set APP_METRICS_TOKEN for Prometheus endpoint protection
• Enable TLS termination at load balancer
• Review and customize APP_OUTPUT_POLICY_BLOCK_PATTERNS
• Set APP_ENV=production and APP_LOG_FORMAT=json