# Security and Privacy Baseline

- All state-changing requests use CSRF protection.
- Passwords use Werkzeug's adaptive password hashing; plaintext passwords are never stored.
- Sessions use HttpOnly, SameSite=Lax cookies; production must enable Secure cookies and HTTPS.
- Role permission and record-scope checks are enforced server-side.
- Anonymous display does not erase the reporter link; protected identity is limited to explicitly authorized roles.
- Upload filenames are randomized, types are allow-listed, size is limited, and download requires authenticated incident access.
- Security headers include CSP, frame protection, MIME sniffing protection, referrer policy, and disabled device APIs.
- Authentication, administration, workflow changes, exports, and attachment viewing are audited.
- Logs rotate locally. Protect them from web access and include them in the secure operational backup plan.

## Production recommendations

1. Terminate only modern TLS and force HTTPS.
2. Place the database and storage outside the public document root.
3. Use a dedicated least-privilege database account.
4. Configure encrypted backups and test restoration.
5. Add host-level malware scanning for uploads if available.
6. Define retention and legal-hold rules before go-live.
7. Review accounts and all-branch permissions quarterly.
8. Integrate SSO/MFA if required by organizational policy.
9. Run dependency and application security scans before every release.
10. Perform a privacy impact assessment for patient and workforce data.