# Morbrick Security Hardening

**Baseline:** OWASP Top 10:2025  
**Application:** Morbrick Sales & Finance Platform  
**Framework:** Laravel 12 / PHP 8.4

## Implemented Controls

| OWASP 2025 category | Controls |
|---|---|
| A01 Broken Access Control | Verified sessions, centralized route permissions, least-privilege roles, final-admin deletion protection, private document storage, signed public verification URLs. |
| A02 Security Misconfiguration | Central security headers, authenticated-response cache prevention, hardened session defaults, private disk serving disabled, production environment checklist. |
| A03 Software Supply Chain Failures | Locked Composer/npm dependencies and repeatable `composer audit` / `npm audit` checks. |
| A04 Cryptographic Failures | Laravel password hashing, encrypted sessions, signed document URLs, SHA-256 document integrity, eTIMS communication key redaction. |
| A05 Injection | Laravel validation, Eloquent parameter binding, escaped Blade output, constrained enums and identifiers, restricted official KRA endpoint. |
| A06 Insecure Design | Payment idempotency, database locks and transactions, guarded financial workflows, role separation between creation, approval, and payment. |
| A07 Authentication Failures | Login/reset/confirmation throttles, 12-character complex replacement passwords, session regeneration, other-session invalidation, generic reset responses. |
| A08 Software or Data Integrity Failures | Signed QR verification, sealed document hashes, deterministic eTIMS idempotency, no untrusted deserialization. |
| A09 Logging and Alerting Failures | Request IDs, authentication event logging, mutation audit events, identifiers hashed and request bodies excluded. |
| A10 Mishandling of Exceptional Conditions | Bounded external HTTP timeouts, generic production errors, request-correlated server logs, transactional rollback for financial workflows. |

## Required Production Configuration

Set these values only after HTTPS is working through the web server and any trusted proxy:

```dotenv
APP_ENV=production
APP_DEBUG=false
APP_URL=https://your-production-domain.example
SECURITY_ALLOWED_HOSTS=your-production-domain.example
SECURITY_ENFORCE_TRUSTED_HOSTS=true
SESSION_SECURE_COOKIE=true
SESSION_HTTP_ONLY=true
SESSION_SAME_SITE=strict
SESSION_ENCRYPT=true
SECURITY_HSTS_ENABLED=true
LOG_STACK=daily
LOG_LEVEL=warning
```

The production web server must:

1. Use the Laravel `public/` directory as its only document root.
2. Redirect HTTP to HTTPS and permit TLS 1.2 or newer.
3. Deny access to dotfiles, `.env`, `storage/`, `vendor/`, database dumps, and logs.
4. Run PHP with `display_errors=Off`, `log_errors=On`, and `expose_php=Off`.
5. Run queue workers under a non-administrator OS account and restart them after releases.

The production database must use a dedicated non-root account restricted to the Morbrick schema. Enable encrypted connections and storage-level encryption where supported. Encrypt backups, restrict access, and test restoration regularly.

## Operations

- Monitor `security_events` for repeated `auth.failed`, `auth.lockout`, forbidden requests, and unusual mutation volume.
- Run `composer audit --locked` and `npm audit --omit=dev` in CI and before every production release.
- Rotate `APP_KEY`, eTIMS, mail, database, and payment credentials through a documented incident procedure. Rotating `APP_KEY` invalidates encrypted sessions and data, so it requires a planned migration.
- Retain security events according to the organization’s privacy and audit policy, then purge them using a scheduled retention job.

## Residual Controls

- The current UI uses inline scripts and styles, so the enforced CSP allows inline content. Move inline scripts into the Vite bundle and adopt CSP nonces before removing `unsafe-inline`.
- Database transparent encryption, TLS termination, firewalling, malware scanning, backups, alert delivery, and secret-vault integration are infrastructure controls and cannot be guaranteed by Laravel code alone.
- A professional penetration test remains required before exposing payroll, employee identity, banking, and production payment data to the internet.

References: [OWASP Top 10:2025](https://owasp.org/Top10/2025/0x00_2025-Introduction/), [Laravel Security Documentation](https://laravel.com/docs/12.x/authentication).