# Security Architecture & Production Hardening

The Calian platform employs defense-in-depth architecture to safeguard guest personal data, financial transactions, and hotel operations.

---

## 1. Security Protocols & Safeguards

- **Transport Security:** Strict HTTPS enforcement with HSTS headers and secure cookies (`SameSite=Lax`, `Secure`, `HttpOnly`).
- **CSRF & XSS Protection:** CSRF tokens validated on all mutating HTTP requests; React JSX auto-escaping eliminates raw HTML injections.
- **SQL Injection Defense:** Strict parameter binding and Eloquent ORM queries throughout.
- **Password Security:** Passwords hashed with standard Bcrypt (`rounds=12`) with strict strength validation.
- **Rate Limiting & Throttling:**
  - Login attempts throttled to 5 requests per minute with exponential backoff.
  - Public booking search and Pesapal IPN endpoints rate-limited to mitigate DDoS and brute-force scans.
- **Granular RBAC:** Server-side policy checks (`$user->hasPermission(...)` and Laravel Gates) protect every administrative endpoint.
- **Audit Trails:** Immutable audit logging of all sensitive administrative modifications (rates, discounts, cancellations, folios, user roles).
- **Zero Raw Secrets in Logs:** Pesapal API secrets, passwords, and raw credit details are masked and never persisted in debug logs.