# Security Requirements

Role-based permissions, validation, audit logs, and secure file handling.

Authorization uses Laravel policies for users, projects, reports, report exports, comments, and private attachments.

Login attempts are rate limited. Password reset is available through email reset links.

Audit logs capture key user, project, report, export, PDF, and file-access actions for administrators.

Users can update their own password from the profile screen.

Private uploads stay outside the public web root and are only served through authenticated routes after authorization checks.

Admin maintenance actions such as test emails and backup downloads are audited.

Client report sharing uses unguessable revocable tokens and only works for approved reports. Shared links can expire and do not expose authenticated application navigation.

Backup restore requires admin access and an explicit RESTORE confirmation phrase.

Backup file restore ignores unsafe archive paths and only writes files under configured private/public storage roots.

Offline sync storage stays in the user browser via IndexedDB. The service worker caches static assets only, not authenticated report pages or private attachments.

Queued offline submissions remain in the browser when the session expires and require the user to sign in again before retrying sync.