Security Level: Internal Last Review: 2026-07-19 Next Review: 2026-10-19 Owner: Ryan Roland Dabao Status: Active Implementation

• Mitigation: Role-based access control (RBAC) with principle of least privilege
• Implementation: Middleware checks on all protected routes via src/middleware.ts
• Testing: Automated tests for unauthorized access attempts
• Status: ✅ Implemented (ADR-004, ADR-005)

• Mitigation: TLS 1.3 for data in transit, AES-256 for data at rest
• Implementation: HTTPS enforced via Vercel, encrypted database fields
• Testing: SSL configuration scans
• Status: ✅ Implemented

• Mitigation: Parameterized queries, input validation, prepared statements
• Implementation: Prisma ORM with parameterized queries, input sanitization
• Testing: SQL injection tests, XSS tests
• Status: ✅ Implemented (Prisma middleware)

• Mitigation: Threat modeling, secure design patterns
• Implementation: Security architecture review in design phase (ADR-004)
• Testing: Penetration testing
• Status: ✅ Implemented

• Mitigation: Hardened defaults, minimal attack surface
• Implementation: Security headers via Next.js, disabled debug mode in production
• Testing: Configuration audits
• Status: ✅ Implemented

• Mitigation: Regular dependency updates, vulnerability scanning
• Implementation: Dependabot for automated updates, gitleaks for secret detection
• Testing: Snyk/OWASP Dependency Check
• Status: ✅ Implemented

• Mitigation: Secure password policies, JWT with short expiration
• Implementation: JWT in HttpOnly cookies (ADR-004), refresh token rotation
• Testing: Brute force protection tests
• Status: ✅ Implemented

• Mitigation: Code signing, integrity verification
• Implementation: CI/CD pipeline with signed commits, audit logging
• Testing: Integrity checks
• Status: ✅ Implemented

• Mitigation: Comprehensive audit logging
• Implementation: AuditLog table for all admin mutations (ADR-014)
• Testing: Log integrity verification
• Status: ✅ Implemented

• Mitigation: Input validation, allowlist for external requests
• Implementation: URL validation, network segmentation
• Testing: SSRF attack simulations
• Status: ✅ Implemented

• Minimum Length: 12 characters
• Complexity: Upper, lower, number, special character
• Expiration: 90 days (optional)
• History: Cannot reuse last 12 passwords
• Lockout: 5 failed attempts → 15 minute lockout

• Token Type: JWT with jose library (RS256 signing)
• Storage: HttpOnly Secure SameSite=Strict cookie
• Expiration: 15 minutes (access), 7 days (refresh)
• Rotation: Refresh token rotation on each request
• Invalidation: Client-side cookie clear on logout

• Collection: Minimal necessary data (email, name, payment info)
• Storage: Encrypted fields in PostgreSQL
• Access: Audit logged, role-based
• Deletion: Right to be forgotten supported (GDPR)
• Export: Data portability available

• Request Schema: Next.js validation
• Content-Type: Whitelist allowed types
• File Upload: Type, size, and content validation
• SQL Injection: Prisma parameterized queries only

{
  "origin": ["https://amph-v2.vercel.app"],
  "methods": ["GET", "POST", "PUT", "DELETE"],
  "credentials": true,
  "maxAge": 86400
}

• Hosting: Vercel (managed infrastructure)
• DDoS: Vercel built-in protection
• WAF: Vercel Web Application Firewall

• Base Images: Minimal, distroless images
• Scanning: Trivy/Clair for vulnerabilities
• Signing: Image signing with Cosign
• Runtime: Read-only filesystem where possible

• Storage: Environment variables (Vercel Environment Variables)
• Rotation: Manual rotation for critical secrets
• Access: Least privilege, audit logged
• Never: In code, logs, or environment variables

• Privacy policy published
• Cookie consent implemented
• Data processing agreements
• Right to access/delete
• Data breach notification process

• Access controls documented
• Audit logging enabled
• Incident response plan
• Vendor management
• Regular security assessments

• Privacy policy published
• Cookie consent implemented
• Data processing agreements
• Right to access/delete
• Data breach notification process

1. Detect: Automated alerts (Sentry) + manual reports
2. Contain: Isolate affected systems
3. Eradicate: Remove threat
4. Recover: Restore systems
5. Learn: Post-incident review

• Input validation on all user inputs
• Parameterized queries for database (Prisma)
• Proper error handling (no sensitive data in errors)
• Security headers configured
• CORS properly configured
• Authentication on all protected routes

• HTTPS enforced (Vercel)
• Security headers enabled
• Debug mode disabled
• Default credentials changed
• Unnecessary services disabled
• Firewall rules configured

• Monitoring and alerting enabled (Sentry)
• Log aggregation configured
• Backup and recovery tested
• Incident response plan documented
• Security training completed

src/lib/        ← Pure utilities, no deps
   ↑
src/components/ ← UI primitives, depend on lib
   ↑
src/app/        ← Routes, depend on components + lib
   ↑
tests/          ← Mirror src structure

1. Middleware Layer: JWT verification, RBAC checks
2. Server Actions: Input validation, business logic
3. Database Layer: Prisma ORM, parameterized queries
4. External Services: PayMongo, Resend, Vercel Blob

• Scope: All admin mutations
• Storage: AuditLog table
• Retention: 2-year retention, then archival
• Viewable: /admin/audit-log

For security issues, contact:

• Email: security@projectamazonph.com
• Emergency: ryan@projectamazonph.com

© 2026 Project Amazon PH. All rights reserved.