Security boundaries

Trust boundaries

Layer	Measure
Browser to Firebase	HTTPS enforced by Firebase Hosting
Browser to Render	HTTPS enforced by Render
Render to Neon	TLS enforced by Neon (`sslmode=require`)
Render to R2	HTTPS enforced by Cloudflare

Helmet is applied globally:

helmet({
  crossOriginResourcePolicy: { policy: 'cross-origin' },
  contentSecurityPolicy: false,  // Disabled for SPA compatibility
})

CSP is disabled because the React SPA loads inline scripts and styles that CSP would block. This is a known trade-off tracked in Known limitations.

SameSite=None is required because the frontend (Firebase) and backend (Render) sit on different origins. See Authentication.

Measure	Implementation
SQL injection	Prisma parameterized queries; no raw SQL in application code
XSS	React’s JSX escaping plus Helmet headers
CSRF	SameSite cookies plus CORS origin restriction
Request size	20MB limit via `express.json`
Unknown fields	`ValidationPipe` with `whitelist: true` and `forbidNonWhitelisted: true`

app.enableCors({
  origin: allowedOrigins.length > 0 ? allowedOrigins : true,
  credentials: true,
});

Origins are parsed from the FRONTEND_ORIGIN environment variable: the Firebase Hosting URL in production, http://localhost:5173 in development.

Vector	Risk	Current mitigation
Credential theft	Medium	Session cookies are HttpOnly + Secure; no JWT in localStorage
Session hijacking	Low	Secure flag enforces HTTPS-only cookies
SQL injection	Very low	Prisma parameterized queries throughout
XSS	Low	React escapes JSX by default; Helmet adds headers
CSRF	Low	SameSite cookies plus CORS origin check; no state-changing GET endpoints
Privilege escalation	Medium	Three-guard authorization stack plus service-layer scope checks
Cross-client data leak	Medium	Application-layer clientId filtering; no database-level RLS
Denial of service	Low	Rate limiting at 100 req/min
Supply chain	Medium	Dependencies pinned in lockfile; no automated vulnerability scanning

Security gaps (MFA, CSP, RLS, account lockout, and others) are tracked with priorities in Known limitations and scheduled in Future architecture.