# Security baseline — every EDEN endpoint

Checklist (Master Prompt §12):
- Security headers (helmet-equivalent) + adequate CSP.
- CORS by allowlist per environment (legacy had none configured — deliberate improvement).
- Server-side input validation, output encoding, parameterized queries only (never string-concat SQL).
- File upload: real MIME validation, size limits, stored outside webroot, malware-scan hook point.
- Rate limiting: by IP AND by identity/token for sensitive routes (never just one dimension — legacy pattern, keep it).
- Anti-enumeration on auth flows (forgot-password always returns success regardless of whether the email exists).
- Authorization resolved server-side from session — never trust `role`/`customer_id`/`reseller_id`/`legal_entity_id` from the client.
- Mass-assignment protection (explicit field allowlist on every PATCH, mirroring the legacy pattern of CPF/CNPJ never being in the admin-PATCH allowlist).
- SSRF prevention on anything that renders external content (PDF renderer must never navigate the network — `setContent` only, block all outgoing requests).
- Request size limits, secure cookie/token handling, dependency scanning, secret scanning in CI.