Protos-Web Security Checklist

SSL/TLS

• [ ] Valid SSL certificate installed
• [ ] TLS 1.2 or 1.3 only (disable 1.0/1.1)
• [ ] HSTS header with long max-age
• [ ] No mixed content warnings

HTTP Headers

• [x] Content-Security-Policy configured (CSP 'unsafe-inline' removed, SHA-256 hashes in place)
• [x] X-Frame-Options: DENY
• [x] X-Content-Type-Options: nosniff
• [x] Referrer-Policy set appropriately (strict-origin-when-cross-origin)
• [x] Permissions-Policy restricting APIs (camera=(), microphone=(), geolocation=())
• [x] Cross-Origin-Opener-Policy: same-origin
• [x] Cross-Origin-Resource-Policy: same-origin
• [ ] CSP reporting endpoint (report-uri or report-to directive)
• [ ] server header hidden (Vercel always exposes this — infrastructure limitation)

CORS

• [ ] Access-Control-Allow-Origin: * removed from Vercel dashboard (project-level header, not in code)
• [ ] Edge Functions CORS restricted to https://www.protosweb.eu (currently * on donation-checkout, content, donation-confirm)

Cookies

• [ ] Secure flag on all cookies (NEXT_LOCALE currently missing — next-intl middleware limitation)
• [ ] HttpOnly flag on all cookies (NEXT_LOCALE currently missing)
• [x] SameSite attribute set (lax on NEXT_LOCALE)

Authentication

• [x] Strong password policy enforced (HMAC SHA-256 session cookie protos-admin-session)
• [ ] Multi-factor authentication (MFA) enabled
• [x] Rate limiting on login endpoints (failed attempts only, /api/admin/login)
• [x] Secure session management (HttpOnly + Secure + SameSite=Lax on admin cookie)
• [x] Admin secret in Vercel env only, never in Supabase
• [x] Admin behind proxy middleware (src/proxy.ts) + requireAdmin() on data operations

Infrastructure

• [ ] Web Application Firewall (WAF) active (Cloudflare proxy NOT enabled — DNS-only mode)
• [ ] DDoS protection enabled (Cloudflare not proxying — Vercel's built-in DDoS only)
• [ ] Server version headers hidden (Vercel sets server: Vercel — cannot be removed)
• [ ] Regular security patches applied (22 dependabot vulnerabilities open: 13 high, 9 moderate)

DNS / Email Security

• [ ] DMARC policy p=quarantine or p=reject (currently p=none — no enforcement)
• [x] DKIM configured (Zoho: zmail._domainkey)
• [ ] MTA-STS configured
• [ ] DNSSEC enabled
• [ ] CAA records configured
• [ ] HSTS preload list submitted

DNS Architecture (current)

• Nameservers: Cloudflare (howard.ns.cloudflare.com, liberty.ns.cloudflare.com)
• DNS mode: DNS-only (orange cloud OFF — A records point directly to Vercel IPs)
• Hosting: Vercel (216.198.79.1, 64.29.17.1 = VERCEL-05)
• Email: Zoho Mail (mx.zoho.eu + SPF/DKIM/DMARC)

Files

• [x] security.txt with Expires, Contact, Preferred-Languages, Canonical, Policy
• [ ] robots.txt — /admin and /api/ paths exposed (intentional transparency, but flagged)

Automated Checks

• [x] next.config.js headers section: securityHeaders array applied to all routes
• [x] vercel.json — framework + redirects only, no conflicting headers
• [x] supabase/functions/* — Edge Functions at https://wgoccdtpigkwuwlqqzvx.supabase.co