Security
Controls include tenant-scoped authorization, MFA for Master Admin, CSRF on cookie mutations, SSRF-safe crawling, prompt-injection resistant RAG, signed Stripe webhooks, and hashed secrets. See the operator guide in docs/SECURITY.md.
Controls include tenant-scoped authorization, MFA for Master Admin, CSRF on cookie mutations, SSRF-safe crawling, prompt-injection resistant RAG, signed Stripe webhooks, and hashed secrets. See the operator guide in docs/SECURITY.md.