Application Security & Secure SDLC
Status
Owner: Tech lead · Status: draft · Canonical source: flezi.app.api.backend/app/middleware/
Details software-level defenses addressing OWASP Top 10 vulnerabilities and secure development lifecycle controls.
Defenses Summary
| Vulnerability | Mitigation in Flezi Galaxy |
|---|---|
| Injection | Parameterized queries via SQLAlchemy/SQLModel ORM; sandboxed shell execution. |
| Broken Authentication | Short-lived JWTs, bcrypt password hashing, strict CSRF/CORS origins. |
| Data Exposure | At-rest and in-transit encryption; automated password and token masking. |
| Cross-Site Scripting (XSS) | React automatic JSX escaping, strict CSP headers, sanitized input renderers. |
| Broken Access Control | Enforced permission checks via require_permission on 100% of endpoints. |
| Rate Limiting & DoS | IP- and user-scoped rate limiting middleware on critical routes. |
Secure SDLC Standards
- Mandatory peer review on all pull requests.
- Automated linting, static type checking, and unit testing required before merging.
Existing Controls
- Enforced security headers:
X-Content-Type-Options: nosniff,X-Frame-Options: SAMEORIGIN. - Continuous dependency vulnerability scanning via automated CI.
Evidence (Files & Configuration)
flezi.app.api.backend/app/middleware/flezi.docs/nginx.conf
Limitations & Roadmap
- Integrating SAST (Static Application Security Testing) directly into pull request checks.