Security architecture

ADMIN AUTHENTICATION

Email and password through the managed auth provider. No custom password hashing, no passwords stored in application tables.

PUBLIC REGISTRATION DISABLED

There is no sign-up route, form, or endpoint in the application. The single administrator is provisioned out of band.

MULTI-FACTOR AUTHENTICATION

Time-based one-time password enrollment and challenge. The admin console refuses to render until the session reaches the verified assurance level.

ACCOUNT ENUMERATION RESISTANCE

Sign-in and recovery responses are generic and never confirm whether an address is registered.

SESSION HANDLING

Provider-managed sessions with refresh. No custom bearer tokens, no credentials in local storage.

ROLE STORAGE SEPARATION

Roles live in a dedicated table, never on a profile row and never in user metadata, so a client cannot grant itself privileges.

DATABASE ROLE CHECK

A security-definer function resolves the administrator role; every write policy is gated on it.

ROW LEVEL SECURITY

Enabled on every table in the exposed schema, deny by default. Visitors read published rows only.

EXPLICIT GRANTS REVIEWED

Visitors hold read privileges only. No insert, update, or delete privilege is granted to anonymous callers on any table.

SERVER-SIDE AUTHORIZATION

Every mutation re-checks the administrator role server-side before touching data. The route guard is user experience, not the security boundary.

FAIL-CLOSED BEHAVIOUR

Missing, expired, or unverifiable authorization state denies access rather than degrading to a permissive default.

SERVER-SIDE INPUT VALIDATION

Schema validation on every mutation boundary: type, length, allowed values, and URL protocol.

FIELD ALLOWLISTING

Editable columns are enumerated per table, so identifiers, timestamps, and role columns cannot be mass-assigned from a browser payload.

OUTPUT ENCODING

All content renders as text nodes. dangerouslySetInnerHTML appears nowhere in the codebase.

URL PROTOCOL FILTERING

Only http and https links are rendered. javascript: and data: URLs are rejected before reaching the DOM.

TERMINAL COMMAND ALLOWLIST

No interpreter, no shell, no eval, no dynamic code execution, no user-supplied query. Input is matched against a fixed command map.

INJECTION PREVENTION

All database access goes through parameterised client APIs. No query is assembled from user input.

SERVER-SIDE REQUEST FORGERY SURFACE

The application exposes no URL fetcher, proxy, ping, or scan endpoint. Lab data is fictional and local.

ADMIN AUDIT LOG

Create, update, publish, and delete events are recorded with timestamp, event type, resource, and actor. Metadata only.

AUDIT LOG ISOLATION

Audit records are unreadable by anonymous callers and cannot be edited or deleted by anyone.

DATA MINIMISATION

No visitor accounts, no tracking, no analytics, no fingerprinting, no advertising scripts, no third-party JavaScript.

SECRET HANDLING

Only the publishable key reaches the browser. Privileged credentials are never imported into a client-reachable module.

GENERIC ERROR RESPONSES

Visitors receive generic failures. Database and infrastructure detail is not surfaced in the interface.

CONTENT SECURITY POLICY

Restrictive CSP with frame-ancestors none, plus nosniff, Referrer-Policy, Permissions-Policy and HSTS, delivered as real response headers.

CONTACT PIPELINE

Server-validated contact intake with rate limiting, bot protection, and a defined retention window.

AUTHENTICATION RATE LIMITING

Application-layer throttling on sign-in and recovery beyond the provider defaults.

FILE UPLOAD PIPELINE

Admin-only uploads with extension and detected content-type allowlists, size caps, and server-generated object paths.

AI RECRUITER ASSISTANT

Read-only retrieval over an explicitly approved public knowledge base, with prompt-injection containment and rate limiting.

AUTOMATED SECURITY TESTS

Executable negative-authorization suite covering anonymous and non-admin mutation attempts.