# Security Baseline

- Backend authorization for every restricted resource.
- Password hashing using an approved adaptive password KDF in the implementation phase.
- Secure, HttpOnly, SameSite cookies for browser sessions where appropriate.
- 2FA for privileged roles.
- Rate limiting and brute-force protection.
- CSRF controls for cookie-authenticated state changes.
- Input validation and output encoding.
- Parameterized database access through the selected data layer.
- Restricted file types, size limits, malware-scan hook and private object storage.
- Signed download URLs for restricted documents.
- Secrets loaded from environment/secret manager and never committed.
- Structured security and audit logs without leaking secrets/PII.
- Admin actions logged; ordinary admins cannot delete audit records.