# ShasPOS Pro Security Standard

## Backend
- PHP 8.x strict application code.
- Prepared PDO queries only.
- Central `AuthMiddleware`, `TenantMiddleware`, `OutletMiddleware`, `PermissionMiddleware`, `SubscriptionMiddleware`, `RateLimitMiddleware`.
- HTTPS only in production.
- Production-safe errors: no stack traces, SQL or filesystem paths.
- Passwords via `password_hash()`; Argon2id when supported, otherwise `PASSWORD_DEFAULT`.
- Rotating refresh tokens; only token hashes stored server-side.
- Reuse of revoked refresh-token family can revoke the family.
- Login throttling by email/account + IP.
- Reset/verification tokens hashed, expiring, single-use.
- Super Admin forms use CSRF plus secure/HttpOnly/SameSite cookies.
- API bearer requests do not rely on CSRF as their authentication control.
- Server-side tenant/RBAC/subscription enforcement.
- Transaction + row locks for inventory/FIFO/cash/subscription payment posting.
- Audit critical role, staff, billing, refund, void, adjustment, approval and variance actions.

## Payments
- No API secret/webhook secret in Flutter or browser JavaScript.
- Gateway configuration encrypted at rest; encryption key stored outside DB/public root.
- Constant-time signature comparison.
- Preserve raw webhook body.
- Idempotent event processing.
- Redirect/return URL is never payment proof.
- ShasPOS Pro does not store payment card details.

## Flutter
- Package: `com.shastech.shaspospro`.
- Android/desktop refresh tokens use platform secure storage.
- Flutter Web has no promise of device-secret storage; keep sessions limited and protect against XSS.
- No secrets in assets or compiled environment values.
- No offline transaction queue.

## Files
- Store outside public root where possible.
- Opaque filenames, server-side MIME detection, allowlists, size limits.
- Never execute uploaded content.