Application controls
- Strict content-security policy, frame denial, MIME sniffing protection, restrictive permissions policy, and HSTS in production.
- Session and job tokens are high-entropy, stored as keyed hashes, sent in HttpOnly cookies or explicit request headers, and never returned after creation.
- API secrets are shown once; the service stores a keyed hash and limited visible prefix.
- Sensitive retained payloads are encrypted separately from lookup metadata.
- State-changing cookie requests require an accepted origin; API clients authenticate by bearer scope.
- Audit events contain identifiers and aggregate metadata, not evidence passages, and are hash chained for tamper evidence.
Document boundary
Uploads are size- and type-bounded, signature-checked, parsed with page/structure limits, rejected for macros, embedded objects, traversal paths, compression bombs or encryption, and subjected to configured malware scanning. The original filename is not stored. Local de-identification occurs before external verification calls.
Outbound boundaries
Evidence links and webhook destinations must be public HTTPS. Private, loopback, link-local, reserved, credential-bearing and nonstandard-port destinations are blocked; configured webhook destinations receive an additional DNS resolution check.
Infrastructure posture
Production configuration fails closed when managed encryption, token, HTTPS or database requirements are absent. Liveness and readiness are separate. Deployments use an isolated staging target, explicit build identity, controlled service restart and rollback artifact.
Known boundary
Security controls require ongoing dependency scanning, configuration review, backup restore tests, alert validation and external testing. Report suspected vulnerabilities through the disclosure policy.