Security Hardening

I want to do a complete security audit and fix all vulnerabilities in this application.
We are a cybersecurity company, so our own products must be hardened first.

Work through the following phases completely. For each finding, fix it in code where
possible. If it requires ops/DNS/infrastructure action, document it clearly with the
exact command or config change needed.

---

## PHASE 1 — OWASP Top 10 Audit

Check and fix all 10 categories:

A01 Broken Access Control
- Are all API routes protected with authentication checks?
- Can unauthenticated users call any route that should require login?
- Are there IDOR (Insecure Direct Object Reference) risks? (e.g., /api/invoice/123 —
  does the server verify the invoice belongs to the requesting user?)
- Are admin-only routes guarded separately from user routes?

A02 Cryptographic Failures
- Is SMTP configured with requireTLS / STARTTLS mandatory?
- Are passwords hashed with bcrypt (cost ≥ 12) or argon2?
- Are secrets/API keys stored only in environment variables, never hardcoded?
- Are database connections over TLS in production?
- Is sensitive data (PII, payment info) encrypted at rest?

A03 Injection
- HTML injection: Are user-supplied strings escaped before interpolation into HTML
  email bodies? Add an escHtml() function if not.
- SMTP header injection: Are CR/LF characters stripped from all email headers
  (to, subject, replyTo, filename)?
- SQL injection: Is Prisma (or ORM) used consistently? No raw SQL with string concat?
- Prompt injection: If there is an LLM/AI assistant, does the system prompt include
  an explicit security boundary blocking jailbreaks and context exfiltration?

A04 Insecure Design
- Is there a rate limit on the password reset / forgot-password flow?
  (per-email: 3/hr, per-IP: 10/hr, both silent — no enumeration oracle)
- Is there a rate limit on the sign-up flow?
- Is there a rate limit on the contact / public forms?
- Can users create duplicate accounts via Gmail +alias or dot tricks?
  (canonicalEmail normalisation + unique constraint in DB)
- Is there a payment mock bypass that could be triggered in production?
  (e.g., order_mock_* prefix skipping HMAC — must be gated to NODE_ENV !== "production")

A05 Security Misconfiguration
- Are all security headers set on every route?
  Required: X-Frame-Options: DENY, X-Content-Type-Options: nosniff,
  Strict-Transport-Security: max-age=31536000; includeSubDomains,
  Referrer-Policy: strict-origin-when-cross-origin,
  Permissions-Policy: camera=(), microphone=(), geolocation=(),
  Content-Security-Policy (scoped to known third-party origins only)
- Is there a public/.well-known/security.txt with a responsible disclosure contact?
- Are webhook secrets validated before processing? (missing secret = 500, not bypass)
- Is the Razorpay/PayPal/Stripe webhook secret missing-key case handled?

A06 Vulnerable and Outdated Components
- Run: npm audit
- Upgrade any runtime dependencies with HIGH or CRITICAL CVEs.
- Create .github/dependabot.yml for automated weekly scans.
- Identify which audit findings are dev-tooling only vs. runtime — document the
  distinction clearly.

A07 Identification and Authentication Failures
- Is there rate limiting on changePassword? (5 attempts / 15 min per user)
- Is there rate limiting on sign-in? (check if auth provider handles this)
- Are password change events written to an audit log?
- Are failed password change attempts written to the audit log?
- Are invite acceptance events audited? Email mismatch attempts too?

A08 Software and Data Integrity Failures
- Do all three payment gateway webhooks (Stripe / Razorpay / PayPal) verify HMAC
  signatures before processing?
- Is there webhook event deduplication (idempotency)?
- If the app issues offline / air-gapped license tokens: when a subscription is
  cancelled, is the offline token re-issued with expiresAt = now so air-gapped
  deployments are immediately revoked, rather than running to the original expiry?

A09 Security Logging & Monitoring
- Are security-sensitive events written to an AuditLog table?
  (password change, invite accept, email mismatch, failed auth attempts)
- Is PII removed from console/dev logs? (email bodies, full email addresses combined
  with payment IDs, etc.)
- Document: log retention policy, alerting on repeated failures (ops item).

A10 SSRF
- Does the app make any server-side HTTP requests to user-supplied URLs?
- If yes, is the destination validated against an allowlist?

---

## PHASE 2 — Authentication & Session

- Review the auth middleware. List every public route. Challenge each: should it
  really be public, or does it need auth?
- If there is an AI/LLM assistant API endpoint, is it behind auth? Rate limited?
  (20 req/user/min minimum). Max body size enforced (32 KB)?
- Are Clerk / auth provider session cookies configured as HttpOnly?
- Is there an open redirect risk on the post-login redirect_url parameter?
  Verify the auth provider's allowed redirect URL list is locked down.

---

## PHASE 3 — Rate Limiting Architecture

- Identify all public-facing mutation endpoints (sign-up, sign-in, forgot-password,
  contact, AI chat, etc.)
- Add per-user and/or per-IP rate limits to each.
- Document: if rate limiter is in-memory (Map-based), it is per-instance and not
  safe for serverless / multi-instance deployments. Add a comment pointing to
  Upstash Redis as the production-grade replacement with the migration pattern.

---

## PHASE 4 — Email Security (SMTP)

- Upgrade nodemailer (or email library) to the latest version.
- Add requireTLS: true when not using implicit TLS (port 587 / STARTTLS).
- Strip CR/LF from all header fields: to, replyTo, subject, attachment filenames.
  (SMTP header injection / CRLF injection)
- Remove email body content from dev console logs (PII reduction).
- Document for ops team: SPF, DKIM, DMARC DNS records must be configured.
  Provide the dig command to verify: dig TXT <domain> | grep spf

---

## PHASE 5 — Payment Gateway Hardening

For each gateway (Stripe / Razorpay / PayPal / any others):
- Verify HMAC signature is checked before any DB mutation.
- Verify missing webhook secret env var causes immediate 500 (not bypass with empty key).
- Verify subscription cancellation events expire the license immediately.
- Verify offline token is re-issued with expiresAt = now on cancellation.
- Verify no mock/test payment bypass can be triggered in production.

---

## PHASE 6 — Dependency & DevSecOps

- Run npm audit. Fix all HIGH and CRITICAL runtime CVEs.
- Create .github/dependabot.yml:
  - Weekly npm audits
  - Patch/minor updates grouped to reduce PR noise
  - Security alerts always as separate PRs
  - Labels: dependencies, security
- Create public/.well-known/security.txt (RFC 9116) with:
  - Contact: mailto:security@<domain>
  - Expires: 1 year from today
  - Preferred-Languages: en
  - Canonical URL
  - Policy URL

---

## PHASE 7 — Account Integrity

- Implement canonicalEm