# Security profile

## Implemented

- HTTPS enforcement in production and HSTS on secure requests.
- Secure, HTTP-only, SameSite, encrypted database sessions.
- Session identifier rotation after authentication and invalidation on logout.
- Argon2id password hashing and 12-character minimum for CMS-created users.
- Login throttling by normalized email and IP plus route throttling.
- CSRF protection for browser writes.
- Role-based CMS boundary, with user and settings management restricted to administrator roles.
- Output escaping in templates; CMS text sections render as escaped text.
- Content Security Policy, frame protection, MIME sniffing protection, referrer and permissions policies.
- Server-only MLS OAuth credentials, TLS verification, timeouts, retry limits and disabled-by-default writes.
- Audit records for CMS model creation, updates and deletion without password/2FA secrets.
- Public API rate limiting and hidden withdrawn/deleted/expired listings.
- Environment secrets excluded from source control.

## Required before production

- Enable MFA or organizational SSO for every privileged account.
- Configure password reset and verified email delivery against the selected mail provider.
- Restrict `/admin` by VPN, identity-aware proxy or IP policy where practical.
- Configure WAF/bot protection and upstream request/body limits.
- Run Composer audit and application tests in CI on every deployment.
- Scan uploads before adding CMS media upload support.
- Set database least-privilege credentials and encrypt backups.
- Centralize logs while filtering tokens and personal data.
- Define incident response, access review, offboarding and retention procedures.
- Commission penetration testing before enabling customer accounts or MLS write operations.

The two-factor database columns are reserved, but no improvised TOTP implementation is included. The deployment developer should integrate Laravel Fortify, WebAuthn or the organization's identity provider and test account recovery before production use.