Repository navigation
Security review of the threat model before the first external tenant #112
Description
ADR-0003 (Risk) recommends a security review before the first external tenant, now that the platform is multi-tenant and customer-facing.
Scope:
- Authentication: sessions, lockout, OIDC.
- Tenant isolation (schema per tenant).
- The role matrix.
- Upload handling.
- Deployment secrets.
Owner and reviewer: to be decided by the product owner.
Generated by Claude Code
Activity
amar-python commentedon Oct 26, 2026
Status 26 Oct: open. No security review has been performed yet. Who does it and when is still to be decided by the product owner. This issue stays open until a review is done and its findings are attached.
Generated by Claude Code