Security is a core platform feature.
Security requirements take precedence over feature velocity.
Requirements:
- JWT Access Tokens
- Refresh Tokens
- Secure Cookie Storage
- HttpOnly Cookies
- SameSite Strict
- Secure Flag Enabled
Never store access tokens in localStorage.
Never expose tokens to JavaScript.
Requirements:
- Argon2id hashing
- Strong password policy
- Password reset flow
- Rate limiting
Never use plain SHA256.
Never store passwords.
Use RBAC.
Roles:
- Owner
- Admin
- Analyst
- Viewer
Every investigation must enforce authorization checks.
Never trust frontend permissions.
Requirements:
- Rate limiting
- Input validation
- Request size limits
- Structured error responses
Every request must be validated.
Use least privilege.
Separate:
- Application User
- Migration User
Enable encrypted backups.
Never expose databases publicly.
Use parameterized Cypher.
Never allow raw query execution.
Prevent Cypher Injection.
Use:
Environment Variables
or
Vault
Never commit secrets.
Never hardcode credentials.
Never hardcode API keys.
Treat all uploads as malicious.
Requirements:
- MIME validation
- Extension validation
- Size limits
- Virus scanning pipeline
- Quarantine storage
Never execute uploaded files.
Authenticate all connections.
Authorize all channels.
Prevent unauthorized subscriptions.
Log:
Authentication
Investigation Access
Graph Changes
Role Changes
Report Generation
Agent Actions
Logs must be immutable.
Implement:
CSP
HSTS
X-Frame-Options
X-Content-Type-Options
Referrer Policy
Permissions Policy
Enable:
Dependabot
Dependency Scanning
Container Scanning
Secret Scanning
SBOM Generation
Every new feature must answer:
What can be abused?
What can be stolen?
What can be escalated?
What can be injected?
What can be exposed?
If no answer exists, do not merge.