Security

Security is foundational to the Broadford Living platform. This section documents security practices, audit findings, and recommendations for maintaining a secure system.

Security Layers

┌─────────────────────────────────────────────────────────────┐
│                    Authentication                           │
│           Clerk JWT verification, invite-only               │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────┐
│                    Authorization                            │
│         Role-based access control (RBAC)                    │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────┐
│                   Data Protection                           │
│     Encrypted tokens, parameterized queries, isolation      │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────┐
│                   Service Security                          │
│    HMAC service auth, webhook verification, short tokens    │
└─────────────────────────────────────────────────────────────┘

Security Strengths

Authentication

• Invite-only access: No public sign-ups
• Clerk integration: Enterprise-grade auth provider
• JWKS rotation: Automatic key rotation handling
• Multi-factor: Passkey and OTP support

Data Protection

• SQL injection prevention: Compile-time verified queries via sqlx
• Token encryption: OAuth tokens encrypted at rest
• Data isolation: Per-property Durable Objects
• Environment separation: Strict dev/staging/prod boundaries

Service Communication

• Short-lived tokens: 5-minute expiry for service auth
• Request IDs: Replay protection via JWT jti claim
• Constant-time comparison: Timing-attack resistant signature verification
• Webhook verification: RSA-SHA256 (SmartThings), HMAC-SHA256 (Yale)

Build Security

• Mock mode removed: #[cfg(feature = "mock")] excluded in production
• Secrets management: No credentials in source control
• OTA verification: Ed25519 signatures on all updates

Areas for Improvement

• Rate limiting on API endpoints
• CORS hardening for production
• Security header additions (CSP, X-Frame-Options)
• Error message sanitization for production

Documentation in This Section

• security-audit.md - Comprehensive security analysis
• secret-management.md - Credential handling best practices
• key-rotation-plan.md - Encryption key and seed rotation procedure
• gdpr.md - GDPR posture: roles, lawful basis, access control, retention
• data_breach.md - Personal-data breach detection, triage and notification runbook