Security Model

┌─────────────────────────────────────────────────────────────┐
│                      Network Layer                           │
│  • TLS 1.3 encryption  • DDoS protection  • WAF             │
├─────────────────────────────────────────────────────────────┤
│                    Application Layer                         │
│  • Input validation  • CSRF protection  • Rate limiting     │
├─────────────────────────────────────────────────────────────┤
│                   Authentication Layer                       │
│  • PKCE  • MFA  • Secure password hashing  • Token rotation │
├─────────────────────────────────────────────────────────────┤
│                   Authorization Layer                        │
│  • RBAC  • Org isolation  • Scope-based access              │
├─────────────────────────────────────────────────────────────┤
│                      Data Layer                              │
│  • Encryption at rest  • Audit logs  • Backup encryption    │
└─────────────────────────────────────────────────────────────┘

1. Client generates random code_verifier
2. Client creates code_challenge = SHA256(code_verifier)
3. Authorization request includes code_challenge
4. Token request includes code_verifier
5. Server verifies SHA256(code_verifier) == code_challenge

Permission = Organization + Role + Action

Can user delete members?
├── User belongs to Org A? ✓
├── User role is Admin? ✓
├── Admin can delete members? ✓
└── Result: ALLOWED

// All queries include organizationId
const data = await db.query({
  where: {
    organizationId: req.user.organizationId, // REQUIRED
    ...otherFilters
  }
});

// Passwords never logged or returned
const user = await getUser(id);
delete user.passwordHash; // Never expose
 
// Tokens masked in logs
logger.info('Token issued', { 
  token: `${token.slice(0, 8)}...` 
});

Environment Variables (encrypted)
├── DATABASE_URL
├── JWT_SECRET
├── ENCRYPTION_KEY
└── THIRD_PARTY_SECRETS