What the code actually does

Checked against the code on 2026-09-16

1. Every database query passes through a Prisma extension that pins it to the request's organization, and a query with no organization context fails instead of returning rows.

2. TOTP seeds and third-party provider tokens are stored encrypted with AES-256-GCM, with a keyring that allows key rotation without losing access to existing data.

3. Every HTML response gets a Content-Security-Policy with a per-request random nonce, and an inline script without that nonce does not run.

4. Every state-changing call carrying a staff session must send a CSRF token that matches the cookie, and enforcement cannot be switched off in production.

5. An approval receipt link is signed with HMAC-SHA256, the signature is verified before any database read, and every failure returns the same 404.

   A share link is a 32-byte random token of which only the SHA-256 is stored, with expiry, an optional password and immediate revocation; a revoked, expired or unknown link answers the same 404.

6. Every uploaded file is scanned with ClamAV on a private VM inside the VPC before any rendition is made from it, and a file without a clean verdict is held and not served.

   Files above 2 GiB are held, not scanned. A held file is not served.

7. A client enters the portal with no account, by code, link, phone or email; only an HMAC of the code or token is stored, a door expires (30 days by default), and revocation disconnects every device within two minutes.

8. The activity log is append-only in the application: no code path updates or deletes an audit row, and a CI gate fails on any attempt to add one.

9. Every API route is rate limited per user or client IP through a shared Redis counter across instances; when Redis is unavailable the limit drops to one third per instance instead of opening.

10. The session is a signed JWT cookie (HS256) with HttpOnly, Secure and SameSite=Lax, expires after two idle hours and can be revoked on every device at once; passwords are stored as scrypt hashes, and MFA recovery codes are stored only as HMACs.

11. The portal, share links, receipts, invitation acceptance and the signup-completion and password-reset pages carry noindex, and robots.txt disallows /api/, /admin, /app and /coupons.

12. A workspace owner exports the data and deletes the workspace or their own account without asking us; deletion locks out immediately, and permanent erasure runs automatically after 30 days, the number written in the terms, privacy policy and DPA.

13. Secrets are mounted from Secret Manager at deploy time, validated at startup (minimum length, placeholder values refused, the encryption key must be 32 random bytes) and redacted from logs and error reports.

14. Scheduled calls are authenticated with an HMAC-SHA256 signature inside a five-minute window or a Google OIDC token, and a static bearer secret is refused in production.

15. Every outbound request to a user-supplied address (Drive imports, webhooks) is checked against private address ranges, including after redirects and at connect time.

16. An API request body is capped at 1 MiB and checked against a strict schema that rejects unknown fields before the code touches it.

17. The file type is decided from the bytes themselves rather than the browser's declaration, and a file over the plan's quota or per-file cap is refused before upload.

18. Every object path is checked against the organization prefix before signing, reading or deleting, and files are served through time-limited signed URLs (6 hours to view, 5 minutes to download).

19. AI proposals are stored as proposals and applied only after a person approves, and AI code may not open a system scope over customer data; a CI gate enforces it.

20. Every deploy first passes the full test suite with coverage, the code gates and npm audit at the high level; a production deploy also goes through a canary with readiness probes.