# Security

## Reporting

Report vulnerabilities privately to the project owner or designated security contact. Do not open a public issue containing exploit details, secrets, production URLs, logs, or personal data.

## Secrets and environment

- Never commit `.env`, API keys, passwords, tokens, private keys, cookies, database exports, or production logs.
- Store production secrets in a restricted server environment/secret manager and rotate them after suspected exposure.
- Keep `APP_KEY` stable, secret, and backed up. Regenerating it invalidates encrypted values, cookies, and other protected data.
- Set `APP_ENV=production`, `APP_DEBUG=false`, a correct HTTPS `APP_URL`, and an appropriate production `LOG_LEVEL`.
- Restrict `.env` to the deployment account/web group; never serve the repository root as the document root.

## Application controls

- Validate all untrusted input and authorize every privileged action on the server.
- Use least-privilege roles/permissions. Administrator promotion requires an existing named account; never share administrator credentials.
- Keep Fortify login throttling enabled and encourage two-factor authentication or passkeys for privileged users.
- Use CSRF protection, secure session cookies, HTTPS-only redirects, and trusted proxy settings appropriate to the host.
- Treat uploads as untrusted: enforce extension/MIME/size rules, use generated names, store outside `public/` unless intentionally public, and never execute uploaded files.
- Escape output by default and review any raw HTML, redirects, URLs, file paths, or dynamic queries.

## Operations

- Terminate TLS with a valid, automatically renewed certificate and modern protocol/cipher settings.
- Run PHP-FPM and queue workers as unprivileged users. Only `storage/` and `bootstrap/cache/` need web-process write access.
- Protect MySQL and, when selected, Redis from public access; use dedicated credentials and network restrictions.
- Configure real authenticated mail delivery and protect provider credentials.
- Back up the database, persistent storage, `.env`, and `APP_KEY`; encrypt backups and regularly test restoration.
- Patch the OS, PHP, web server, Composer/npm dependencies, and GitHub Actions pins through reviewed changes.
- Monitor authentication failures, application errors, queue failures, certificate expiry, disk capacity, and backup status. Redact secrets and PII from logs.

## Release assurance

Run the repository quality gate and review dependency advisories before release. Complete [Server acceptance](SERVER-ACCEPTANCE.md) after deployment. Documentation preparation did not validate the security of a server and no deployment occurred.