Chapter 7 - Security Review

Scope

This is a static code/configuration inspection. No penetration testing, dynamic scanning, or runtime testing was performed. Findings are prioritized accordingly.

Observed controls (good)

• Session authentication, email verification optional, password reset throttling.
• Security token based on signed URL for email verify.
• CSRF exceptions limited to external callbacks.
• SaaS/non-SaaS/Impersonation guards.
• Plan limits.
• Workspace suspension enforcement.
• Sensitive status controls by middleware.
• Model event audit.
• Mediators payment security (HTTPS normal - server responsibility).

Assets sensitive in project

• Email account passwords (encrypted on persist).
• API keys (Gemini via Setting table could be plaintext in DB; Stripe via settings UI may also be plaintext).
• Client legal data inside email body/text + attachments + conversations.
• Project financial accounting figures (costs, budgets, invoices).
• Audit history containing IP and user actions.
• IMAP username/password + plaintext config fallback config/imap.php.

Findings

High

1. Database secret fallback in config/imap.php hardcodes user/password (observed in repository code).
2. Missing .env in repo and installer expects .env.example, so secrets may be shared over channels or versioned.

Medium

1. No tenant global scope; isolation largely app-query-level. Must audit all repositories for conditions.
2. Payment setting table (payment_settings) appears to store values plaintext without visible encryption helper (verify row encryption).
3. Plan and AI key stored as "value" text in settings, no visibility for encryption wrapper.
4. Tax/financial report exported way varies CSV includes client data.
5. Http facade used to fetch Gemini (LLM) external with API key in URL; possible query parameter leak relative.
6. Automatic 37 keyboard shortcuts, modal stacks (likely safe).
7. CORS policy inherited from config/cors.php not fully read; default doesn't support native API.

Low

1. No password MFA/CAPTCHA on local login. (optional)
2. No HTTPS enforcement in code (deployment-side).
3. DemoModeMiddleware gives potential bypass only selectively for POSTs; standard only and testing use by default.
4. User password nullable means quick user creation row; product should govern.
5. Rate limiting only Login and AI limited.
6. vendor not updated maybe aging 2026 year; queue options need.

Operational recommendations

• Store API keys in environment or encrypted columns rather than database text.
• Conduct manual permission segregation tests.
• Add tenant global scope or cross-tenant test suite.
• Add monitoring + rate limit for complaints.
• Use secrets management platform for Symfony.