docs/SECURITY.md

# Security Analysis — Multilingual ABSA

## Current State

| Area | Status | Notes |
|------|--------|-------|
| JWT Authentication | ❌ Not implemented | No auth layer |
| OAuth | ❌ Not implemented | No SSO |
| HTTPS | ❌ Not enforced | Expects reverse proxy to terminate TLS |
| Input Validation | ✅ Partial | Pydantic validation present; no server-side max_length |
| SQL Injection | ✅ Protected | SQLAlchemy ORM parameterized queries |
| XSS | ✅ Protected | Streamlit dashboard; no raw HTML rendering, user input via native widgets |
| CSRF | ❌ Not implemented | No CSRF middleware; CORS `"*"` mitigates partially |
| Secrets Management | ⚠️ Manual | `.env` gitignored; Docker Compose has hardcoded dev creds |
| Rate Limiting | ❌ Not implemented | No throttling on any endpoint |
| File Upload Security | ⚠️ Partial | Extension validation; no size limit; temp files not cleaned on success |
| Authorization | ❌ None | No role-based or API-key access control |
| CORS | ⚠️ Permissive | `allow_origins=["*"]` |

## Risks & Recommendations

### Critical

1. **Missing authentication** — All endpoints are publicly accessible
   - **Fix**: Add FastAPI middleware for API key validation
   - **Fix**: Integrate OAuth2/OIDC for multi-user scenarios

2. **No rate limiting** — `/batch` endpoint can be abused (10K rows per request)
   - **Fix**: Add `slowapi` or custom rate-limiting middleware
   - **Fix**: Implement per-IP request quotas

### High

3. **Temp file leak** — Batch CSV saved via `NamedTemporaryFile(delete=False)` but `os.unlink()` only called on validation error, not on success
   - **Fix**: Add `try/finally` block to ensure cleanup

4. **CORS all origins** — `"*"` allows any website to call the API
   - **Fix**: Restrict to known dashboard domains

5. **No server-side text length limit** — `ReviewInput.text` accepts arbitrary length
   - **Fix**: Add `StringConstraints(max_length=512)` to Pydantic model

### Medium

6. **No file size limit on batch uploads** — Only row count limit (10K)
   - **Fix**: Add file-size check (e.g., 50MB max)

7. **Hardcoded credentials** in `docker-compose.yml` — `absa_user/absa_pass`
   - **Fix**: Use environment variables or Docker secrets

8. **CSRF** — No protection; token-based auth (when implemented) would mitigate

### Low

9. **Weak health check** — Returns `"db": "connected"` without actually pinging DB
   - **Fix**: Add actual DB ping to `/health` endpoint

10. **No request logging** — No structured logging or audit trail

## Configuration Checklist

- [ ] Set `ENABLE_METRICS` to `false` if Prometheus not needed
- [ ] Set `LOG_LEVEL` to `WARNING` in production
- [ ] Use strong, random passwords for PostgreSQL
- [ ] Run API behind TLS-terminating reverse proxy (Railway does this automatically)
- [ ] Keep `.env` out of version control (already in `.gitignore`)
- [ ] Rotate secrets regularly