# Security design

This application is designed for Internet-facing shared hosting, but no application can be guaranteed invulnerable. Keep PHP and dependencies patched and review logs/backups.

Implemented controls: forced HTTPS; HSTS after HTTPS is active; secure/HttpOnly/SameSite=Strict cookies; strict PHP sessions and session ID rotation; 30-minute idle and 12-hour absolute session expiry; Argon2id password hashing when available; 12+ character complexity; per-user TOTP 2FA; login throttling by email+IP; CSRF tokens on state-changing forms; PDO native prepared statements; HTML escaping; CSP/X-Frame-Options/nosniff/referrer/permissions headers; RBAC database model; audit log; non-public storage rules; randomized attachment names/hash fields; no directory listing; no SQL credentials in public code; one-time installer lock.

Production checklist: enable SSL first; replace setup key; use a unique DB password; delete/rename setup.php after installation even though it locks; never store config.php in a public Git repo; keep config/storage at 640/750 where hosting allows; enable cPanel 2FA; enable ModSecurity; use ImunifyAV scans; take offsite backups; update Composer packages monthly; review admin users and audit logs; do not disable 2FA.