# Focused application security review

This is a source review plus targeted local tests, not an independent penetration test or a guarantee of complete security. Requirement 132 remains PARTIAL.

## Remediations

- Explicit routing; legacy auto-routing disabled. Global authentication/active-account checks reload the user's role from the database. Granular permissions are enforced before protected admin and warehouse requests; explicit `index.php/` paths are normalized too.
- Staff creation grants no permissions. Owner-only credential and staff administration stays owner-only. Test fixtures require explicit opt-in, development mode and a disposable database name.
- CSRF is globally enabled. Missing-token rejection, anonymous/unauthorized access and unguessable guest order access were tested over HTTP. Login/registration/checkout throttling uses CI4's throttler.
- Passwords use PHP password_hash/password_verify; session IDs regenerate on login. Production example enables HTTPS, HttpOnly/Secure/SameSite cookies and session regeneration. Real TLS/session proxy configuration remains unverified.
- Checkout snapshots and unique checkout hashes prevent duplicate orders. InnoDB row locks serialize SKU reservations, cancellations and manual settlement. Concurrent last-unit reservations, duplicate COD settlement, duplicate cancellation, duplicate refund and duplicate payout were tested.
- Pick/QC/packing/dispatch checks share a state machine. Admin endpoints cannot skip the packing checks. Active creator price bands are validated at display/cart/checkout boundaries.
- Credential saves use AES-256-GCM with a separate environment key. Ciphertext and plaintext secrets are not rendered. Encryption roundtrip and tamper rejection were tested; no real credentials were used.
- Rich text uses a server-side DOM allowlist. Ordinary fields are escaped at output. Custom scripts are confined to sandboxed opaque-origin frames, with CSP blocking network requests and forms. Sanitizer unit tests and stored-field escaping tests passed. Actual hostile-browser execution testing remains unverified.
- Media handling verifies MIME, allowed extension, size and image structure, uses randomized names, and denies executable uploads in the Apache/Nginx examples. HTTP upload/list/delete tests pass, including oversized, forged MIME and executable-extension rejection. Browser upload tests and hostile multi-format corpus testing remain unverified.
- Relational constraints reject orphaned records. Financial events use unique business keys and manual payout updates require a reference/method plus a rechecked available balance.

## Residual review limits

Oracle MySQL, reverse-proxy HTTPS behavior, web-server upload rules, distributed rate limiting, full dependency CVE coverage, concurrent load/failure recovery, all CMS attack payloads, production backups/restore and real provider contracts have not been certified. File-based throttling/session storage is intended for a single PHP installation; multi-node hosting needs explicit shared-cache/session configuration and retesting. The bundled financial event ledger is not an independently audited accounting system.

No gateway callback accepts or books live payments, and no provider activation is offered until a real provider adapter and its authentication/replay tests exist.