# Security hardening (OWASP checklist)

## Implemented

- Security headers (`SecurityHeaders` on API)
- JWT auth + RBAC permissions
- Rate limiting on auth and API
- CSRF-safe JSON API (no cookie session for API)
- Password hashing (bcrypt)
- MFA (TOTP) optional
- ABAC policies (enterprise)
- Fraud velocity + ML scoring
- Audit logs for mutating API calls

## Operational

- Enable HTTPS (HSTS header when TLS detected)
- Configure WAF at CDN (Cloudflare recommended)
- DDoS: rate limits + CDN edge
- Rotate `JWT_SECRET`, Razorpay keys quarterly
- `SENTRY_DSN` for error monitoring

## Pen-test follow-ups

- Review file upload (`POST /api/v1/storage/upload`) size limits in production
- Restrict platform admin IPs if required
- Enable database SSL in production