# Security Architecture — [Your App Name]

> **Instructions for Claude:** Read the project's source code, configuration files, and infrastructure setup to fill in each section. Search for authentication handlers, database schemas, middleware, and deployment configs.

---

## 1. Application Overview

**Application Name:** [Your app name]
**Description:** [One-line description]
**Production URL:** [https://...]
**API URL:** [https://api...]

## 2. Architecture Diagram

```
[User Browser] → [CDN/Edge] → [Application Server] → [Database]
                                     ↓
                              [External APIs]
```

> Replace with your actual architecture. Include all services, databases, and external integrations.

## 3. Trust Boundaries

Define where trust levels change in your system:

| Boundary | From | To | Controls |
|----------|------|----|----------|
| 1. Internet → CDN | Untrusted | Edge | TLS termination, WAF |
| 2. CDN → Application | Edge | Application | [Your controls] |
| 3. Application → Database | Application | Data | [Your controls] |
| 4. Application → External APIs | Application | Third-party | [Your controls] |

## 4. Authentication Flow

> Describe your authentication mechanism. Include:
> - Authentication method (OAuth, passwords, SSO, etc.)
> - Token type and lifecycle (JWT, session cookies, etc.)
> - Token storage (localStorage, httpOnly cookies, etc.)
> - Refresh mechanism

```
1. User initiates login → [Method]
2. [Authentication steps]
3. Token issued → [Storage location]
4. Subsequent requests → [How token is validated]
5. Token refresh → [Refresh mechanism]
6. Logout → [What gets invalidated]
```

## 5. Authorization Model

> Describe how access control is enforced:

| Layer | Mechanism | Description |
|-------|-----------|-------------|
| API/Controller | [e.g., middleware auth check] | [How requests are authorized] |
| Database | [e.g., RLS policies] | [How data access is scoped] |
| Storage | [e.g., bucket policies] | [How file access is controlled] |

## 6. Data Protection

### Encryption at Rest
| Data Category | Method | Key Management |
|--------------|--------|---------------|
| [e.g., OAuth tokens] | [e.g., AES-256-GCM] | [e.g., env var / vault] |
| [e.g., User content] | [e.g., Database-level] | [e.g., Platform managed] |

### Encryption in Transit
| Connection | Protocol |
|------------|----------|
| User → App | TLS [version] |
| App → Database | [Protocol] |
| App → External APIs | [Protocol] |

## 7. Security Headers

| Header | Value |
|--------|-------|
| Strict-Transport-Security | [Your value] |
| Content-Security-Policy | [Your value] |
| X-Content-Type-Options | [Your value] |
| X-Frame-Options | [Your value] |
| Referrer-Policy | [Your value] |

## 8. External Services & Integrations

| Service | Purpose | Data Shared | Authentication |
|---------|---------|-------------|---------------|
| [e.g., Google APIs] | [Purpose] | [What data] | [OAuth/API key] |
| [e.g., Analytics] | [Purpose] | [What data] | [Method] |

## 9. Secrets Management

| Secret Type | Storage Location | Access Method |
|-------------|-----------------|---------------|
| API keys | [e.g., Environment variables] | [e.g., Deno.env.get()] |
| Database credentials | [e.g., Platform managed] | [e.g., Connection string] |
| Encryption keys | [e.g., Vault] | [e.g., Runtime retrieval] |

## 10. Infrastructure Security

> Describe deployment, CI/CD, and infrastructure controls:

- **Hosting:** [Platform]
- **CI/CD:** [Pipeline description]
- **Branch protection:** [Rules]
- **Dependency management:** [Lock file, auditing]
- **Container security:** [If applicable — non-root, pinned images]