# Bugs Fixed

## Fixed During This Audit

- Added a dedicated web security headers middleware for CSP, frame protection,
  MIME-sniffing protection, referrer policy, and browser permissions policy.
- Registered the security headers middleware on the Laravel web middleware stack.
- Added direct Smart Assistant unit coverage for contacts, companies, and leads.
- Added feature coverage proving authenticated pages emit the expected security headers.

## QA Coverage Added

- Added authentication tests for successful login/logout, inactive-user rejection, and invalid-login rejection.
- Added permission test proving a read-only company user cannot create, update, or delete through direct HTTP requests.
- Added Smart Assistant unit tests.
- Added security headers feature test.

## Previously Fixed Before This Audit

- ActivityController parse error shown in old logs is no longer present.
- DashboardController invalid route action shown in old logs is no longer present.
- Current automated test suite passes.
