# Security Baseline

## Implemented controls

- Laravel session authentication with login throttling and session regeneration
- Encrypted, secure, HTTP-only, SameSite=Lax production session cookie
- CSRF protection on all state-changing web actions
- Password hashing through Laravel's current hashing driver
- No public registration or default production credential
- Per-organization memberships and scoped domain queries
- Permission middleware plus controller-level checks for material actions
- Private evidence storage, server-side MIME/size validation, randomized filenames, and SHA-256 checksums
- Optimistic record version checks to prevent silent overwrites
- Auditable material actions
- Production HTTPS forcing behind trusted WHM proxy headers
- `APP_DEBUG=false` production default

## WHM controls still required

- Point the domain document root only to the Laravel `public` directory.
- Enable PHP 8.4 and all required extensions, especially Fileinfo.
- Protect `.env`; never place it in `public`.
- Use a dedicated MySQL user with rights only to the Atlas database.
- Enable AutoSSL for `wiziv.net` before first login.
- Schedule daily database and application backups and perform a restoration test.
- Run `php artisan optimize` after deployment and after every configuration change.
- Keep Laravel and Composer dependencies patched under a controlled maintenance process.
- Enable WHM protections already identified for the server: cPHulk, jailed accounts, and supported kernel/symlink protection.

## Deferred controls before H1 external design partners

- Password reset email flow and optional multi-factor authentication
- Formal access review and account deactivation cadence
- Malware scanning for uploaded files
- Backup/restore evidence and documented RPO/RTO
- Security and privacy review, retention policy, and incident runbooks
- Independent penetration test before any enterprise-readiness claim