Protection built into the foundations.
Targeting applicable OWASP ASVS 5.0 Level 2 controls. Coverage is partial and requires further testing; this is not a certification.
Server-side boundaries
Authenticated ownership is checked for data reads and writes. Mutations require same-origin checks, a custom action header, validated bodies and bounded request sizes. Private responses are not cached.
Sensitive features fail closed
Private document processing requires a trusted scanner and isolated worker. AI and notification actions require explicit configuration, authorization and usage controls. Sharing, payment access and administrative actions remain unavailable unless their additional security requirements are met.
Hosting identity
Candidate accounts use a separate sign-in system with verified email, private server-side sessions and ownership checks. Email verification and password recovery require a configured sender; social sign-in requires approved provider credentials. Administrator access retains its separate password and mandatory authenticator check.
Ongoing verification
The handover includes control mappings, threat analysis, actual test evidence, launch blockers and operational procedures. Independent review, restoration drills and provider end-to-end testing remain necessary.