pokemon-inventory/docs/SECURITY.md

Security

Authentication

MVP:

• email/password
• MFA using TOTP or passkey-capable architecture
• password recovery
• remember-me option
• configurable session expiry
• active session/device management
• revoke one or all sessions

Use secure server-side sessions with:

• HttpOnly
• Secure in production
• appropriate SameSite policy

Never store auth tokens in localStorage.

Authorization

MVP has Admin role.

Design authorization so future roles can be added without rewriting domain logic.

All authorization is enforced server-side.

CSRF

Implement an appropriate CSRF defense for cookie-based authentication.

Input and API security

• Validate all inputs.
• Parameterize database queries through Drizzle.
• Allowlist sort fields.
• Apply pagination.
• Rate-limit sensitive/auth endpoints.
• Use security headers.
• Do not leak private fields through serialization.

Upload security

• Validate MIME type and file signatures where practical.
• Limit size and dimensions.
• Limit image count.
• Process in controlled jobs.
• Treat filenames as untrusted.
• Do not execute uploaded content.

Sessions

Suggested fields: id, user_id, session_token_hash, created_at, expires_at, last_activity_at, ip_address, user_agent, revoked_at

MFA

Suggested fields: id, user_id, type, secret_reference, name, is_enabled, created_at, last_used_at

Secrets must be stored using appropriate secret protection; do not expose raw MFA secrets in logs.

Security audit log

Separate from inventory activity.

Events include:

• LOGIN_SUCCESS
• LOGIN_FAILURE
• PASSWORD_RESET
• MFA_ENROLLED
• MFA_FAILURE
• SESSION_CREATED
• SESSION_REVOKED
• ACCOUNT_UPDATED

Secrets

Credentials, API keys, database URLs, and encryption secrets belong in environment/secret management, never in source control.

Privacy boundary

Private:

• acquisition data
• sale data
• buyer information
• profit
• internal notes
• inventory IDs
• provider observations and errors
• pricing methodology/confidence/history
• activity/audit logs

Public data must be exposed through purpose-built DTOs.