Security Status

Executive Overview — all summaries for decision-makers.

Last updated: 2026-08-04

URL: https://docs.mqa.group/ops/SECURITY-STATUS — not /docs/en/ops/… (repo path ≠ site path).

Implemented ✅

Measure	Details
CORS allowlist	`portal.mqa.group` + env merge
Auth on sensitive APIs	email, pdf, ai-budget, ai-tender, ai-audit-readiness, analytics GET
`/uploads` protected	`authenticate` middleware
Cron fail-closed	`CRON_SECRET` required in production
Mock token blocked	Production frontend + backend
Admin seed API	Development only
Deploy without seed	`docker-entrypoint.sh` → migrate only
Email redirect allowlist	No open redirect
HTML sanitization	DOMPurify in frontend
Security headers	`serve.json` on frontend
PDF download	Auth via fetch + Blob
Env validation	`SKIP_OAUTH_VALIDATION`, `CRON_SECRET`, JWT, CORS
Media Hub → R2	Presigned uploads to MQA-org bucket `mqa-media` (2026-08-04)
Developer docs	VitePress at `docs.mqa.group`; HTTP Basic Auth when `DOCS_PASSWORD` is set on `mqa-docs`

Priority	Topic	Notes
HIGH	JWT in sessionStorage → XSS risk	Evaluate HttpOnly cookies
HIGH	Legacy uploads on Render ephemeral FS	PDF generators, audit/branding multer still write to `/uploads/*` — migrate to R2
HIGH	IDOR Policies/Media/Inquiries	Code review
MEDIUM	Postgres IP allowlist	Restrict in Render Dashboard
MEDIUM	Tighten frontend CSP	Extend serve.json
MEDIUM	Secret rotation after CF migration	Revoke old private R2 keys (T+7); see CLOUDFLARE-MIGRATION
MEDIUM	Docs site access control	Set `DOCS_PASSWORD` on Render `mqa-docs` (Basic Auth; optional `DOCS_USERNAME`, default `mqa`)
LOW	Postgres RLS	Architecture decision

Full audit 2026-08-03 in chat / agent transcript.
CRITICAL fixes from audit: resolved (as of deploy 094f298).

Security incident:

bash

# Backend security tests
cd backend && npm test -- --testPathPattern=security

# npm audit (CI)
npm audit --audit-level=high

Quarterly or before major release.