6. Security Posture

Authentication and authorization

Passwords are hashed with bcrypt at cost 10 (pkg/utils/HashPassword). Authentication uses short-lived JWT access tokens plus rotating refresh tokens from pkg/jwt/. Authorization is handled by RBAC middleware (pkg/middleware/rbac.go) with a 5-minute permission cache and wildcard resource:action matching; the cache is invalidated when a role or permission changes. System roles are immutable, while custom roles allow permission selection.

Data protection

Sensitive fields are encrypted with AES-GCM via pkg/encryption/. The portal-credential vault layers that encryption with per-organization key derivation. Row-Level Security runs alongside application-layer tenant filtering so tenant isolation does not depend on a single mechanism.

Request and operational hardening

The embedded HTTP server supports TLS, configurable through the install wizard. The middleware layer includes CSRF protection, rate limiting, and an IP allowlist (pkg/middleware/), and audit logging runs on every state-changing endpoint. Recovery options include security questions for account recovery and standard password-reset flows. The install wizard itself is hardened with the .installed marker and atomic config writes. An error taxonomy in pkg/errors/AppError maps application errors to the correct HTTP status codes.