# Security Report

## Passed In Automated Tests

- Guest users are redirected from protected pages.
- Active users can log in and log out.
- Inactive users cannot log in.
- Invalid credentials do not authenticate.
- Read-only users cannot create, update, or delete companies through direct requests.
- Cross-branch record access is covered for several modules.
- Global search does not return another branch's records.
- CSRF tokens exist in Blade write forms.
- Authenticated web pages send baseline security headers:
  `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`,
  `Permissions-Policy`, and `Content-Security-Policy`.

## Security Strengths

- Auth login includes `is_active => true`.
- Login throttling middleware is applied to login POST.
- Session is regenerated after login.
- Logout invalidates the session and regenerates CSRF token.
- Branch guards exist in controllers.
- Form Requests constrain related IDs to the authenticated user's branch.
- Audit log redacts password/token/secret-like fields.
- A dedicated `SecurityHeaders` middleware now adds clickjacking,
  MIME-sniffing, referrer, permissions, and CSP protections.

## Security Risks

- No dedicated Policy classes yet.
- HSTS is not enabled yet; it should be added only after HTTPS is enforced in production.
- No production `.env` hardening proof.
- No file upload/download module or file authorization tests yet.
- Browser console and CSP behavior not tested.

## Verdict

Security is suitable for local development and current automated feature coverage, but not production-ready.