> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spurtcommerce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

Security controls must be enforced by the backend and deployment environment, not only by storefront UI behavior.

## Application security

* Require HTTPS outside local development.
* Authenticate protected requests and authorize each action/resource.
* Enforce tenant isolation and object ownership checks.
* Validate and normalize all client input.
* Use parameterized database access and safe ORM query construction.
* Rate-limit authentication, OTP, password reset, and sensitive endpoints.
* Protect against CSRF where cookie-based sessions are used; configure CORS narrowly.
* Verify webhook signatures and reject replayed events where supported.
* Validate uploaded file contents and storage permissions.

## Secrets and credentials

The repository template includes JWT and cryptographic secret settings, database credentials, mail credentials, and cloud-storage credentials. Generate unique secrets per environment, store them outside source control, rotate them, and revoke exposed credentials promptly.

## Operational security

Patch supported runtimes/dependencies, restrict network access, protect monitor/API documentation routes, enable database backups/encryption, and centralize security-relevant audit logs. Redact tokens, passwords, payment details, and personal data.

## Verification

Run dependency scanning, static analysis, API authorization tests, upload tests, and deployment configuration reviews. Test negative cases (unauthorized, cross-tenant, expired token, malformed payload) as carefully as successful flows.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.