Authentication and sessions
- Passwords are hashed with bcrypt before storage.
- Repeated sign-in attempts are throttled.
- Session cookies are signed, HTTP-only and SameSite=Lax; production cookies are marked Secure.
- Production refuses weak or missing session-signing secrets.
- Unknown-account sign-in attempts perform a real password-hash comparison to reduce account-enumeration timing differences.
Requests, roles and organization boundaries
- Authenticated state-changing requests use origin checks and a session-bound CSRF token; sign-in is protected by origin checks.
- Owner, manager, member and viewer capabilities are enforced by the server, not only hidden in the interface.
- The active organization comes from the authenticated session rather than request input.
- Changes are recorded in the product activity history.
Uploads and browser protections
- Evidence uploads are limited to an approved set of document and image formats, checked against filename, declared type and file contents.
- Stored filenames use generated keys and path traversal is rejected.
- Security headers restrict framing, scripts, content sources and cross-origin behavior.
Report a concern
Email support@grantconsole.com with “Security report” in the subject. Do not place sensitive records in the public demo or in an initial report.