Security Architecture
Owner: Security
Reviewers: Backend, Web, Mobile, DevOps
Status: Draft
Version: 0.1
Last Updated: 2026-09-16
Review Cycle: Per release
Confirmed Controls
| Control | Status | Notes |
|---|---|---|
| JWT access tokens | PARTIAL | Backend auth stack exists. |
| Refresh token flow | PARTIAL | Opaque refresh token behavior is documented in PRD status. |
| Password hashing | CONFIRMED | Backend dependency includes bcryptjs. |
| API throttling | CONFIRMED | Nest throttler is used. |
| Route guards | PARTIAL | Some permission/scope logic has known temporary bypasses. |
| CORS configuration | CONFIRMED | Environment-driven origins are present in Docker Compose. |
| Activity logs | PARTIAL | Module exists; coverage and retention require confirmation. |
| Secret templates | PARTIAL | .env.example files exist; production secret handling needs enforcement. |
Security Gaps
- Remove temporary auth-scope bypasses before production release.
- Confirm JWT key management for production.
- Define audit log retention and review process.
- Define vulnerability scanning and incident response ownership.