Security Statement

HTTPS everywhere with HSTS (includeSubDomains, preload once confirmed); secure cookies (HttpOnly, Secure, SameSite=Lax/Strict as appropriate); CSRF tokens on state-changing routes; XSS prevention via framework escaping + output encoding + tuned Content-Security-Policy (no blind copy that breaks the app — report in security-baseline.md); X-Content-Type-Options: nosniff; Referrer-Policy: strict-origin-when-cross-origin or stricter; Permissions-Policy restricting geolocation/microphone/camera; frame-ancestors via CSP (X-Frame-Options DENY legacy); server-token suppression; CORS allow-list; trusted-proxy auditing + X-Forwarded-Proto validation; request-ID propagation.

• Server-side input validation + schema validation + pagination/input limits/output filtering on every API; parameterised queries (no string-concatenated SQL); object-level authorisation (anti-IDOR/BOLA) + fail-closed RBAC (User / Security Operator / Admin with explicit permissions: view logs, manage devices, revoke sessions, access vault, export report, delete account, configure policy).
• Least-privilege DB credentials; separate app/admin credentials; service key server-only; frontend never gets unrestricted DB access.
• Secrets in environment/Docker secrets; per-environment config + startup validation; no bundled secrets; secrets scan in CI (fail on API keys, private keys, DB passwords, JWT/OAuth/webhook/payment/cloud credentials in source/config/logs/build).
• Encryption: TLS in transit; AES-256-GCM for vault/password-manager/backup with hardware-backed keys (keystore/enclave), PBKDF2 for PIN/backup passphrases; encrypted SQLite/Hive on-device; S3-compatible backup encryption with tampering rejection.
• File uploads (mobile vault, once released): type/size validation (never trust browser MIME), rename, signed private-by-default URLs with expiry, metadata stripping, malware scan where appropriate, retention/deletion per retention-matrix.
• Payments (once integrated): hosted/tokenised flow; webhook signature verification; no raw card/CVV storage or logging.

Clerk RS256/JWKS verification (expiry, not-before, authorised-party), cached keys; secure session storage + expiry + invalidation; MFA for admins (required) + risk-based step-up; brute-force/credential-stuffing rate limiting; re-authentication for sensitive operations (deletion, export, role/billing changes); login audit logging; device/session management + revocation; IP/device controls where appropriate; separation of duties; dangerous-operation confirmations. Admin audit log covers policy/exports/deletions/roles/vendors/security/billing.

Security + audit logging (redacted: never passwords/tokens/payment secrets/unnecessary personal data/full AI prompts/secrets/private uploads); PII redaction; log retention (app 30d, security per baseline, privacy/audit per retention-matrix) + access permissions; dependency scanning (npm audit), SAST, DAST where appropriate; token-protected metrics; alerting; backup + restore testing; incident monitoring. See /security/report and compliance/incident-response.md (detect → contain → investigate → preserve → classify → identify data/jurisdictions → notify regulator/users where required → remediate → review).

No SOC 2, ISO 27001, PCI, HIPAA, GDPR/CCPA/AI-Act-compliant badges or '100% secure' / 'most secure' claims unless the audit/certification exists and the statement is accurate. Factual controls only. Penetration testing is claimed only if performed (none performed on this site today). Mobile claims (pinning, RASP, MASVS-inspired checks, challenge-response device JWT) describe the product design intent and must be re-verified at launch.

Report: /security/report or security@zdefence.com (see Vulnerability Disclosure Policy). Version 0.9.0-draft, last updated 2026-10-02, next review 2026-12-01.