jobtrackingapp/docs/security/README.md

Security

Security is enforced in the API and deployment topology, not by UI visibility. The current baseline includes tenant owner filters, local/Google/Microsoft identity options, cookie CSRF protection, rate limits, TOTP, session revocation, validated uploads/imports, bounded document parsing, private AI networking, and structured error handling.

• Authentication
• Authorization and tenancy
• Sessions and rate limits
• File and import security
• Current findings and verification limits

Historical audits remain recoverable in ../_archive/; only verified current claims belong here.