What we shipped

What changed: The CSRF token is now rendered into server HTML on every response via a synchronous middleware that reads from the session at request time. The previous client-side fetch on /csrf left an 80ms race window that admitted unverified POSTs in the rapid-login stress test.

Audit: Item #18 in the Jun–Jul 2026 closeout — closing it removes the last form-submission attack vector that survived the session-rollout changes.

Closed: 34/34 items. Includes multi-tenant isolation (9), auth hardening (11), payments (6), data protection (3), infrastructure (3), and AI safety (2).

Audit methodology: The full report, the line-number references for each fix, and the not-passing-yet list (now empty) are all in /security/summary.pdf.

This is the audit-closeout the /trust page is built on top of.

What shipped: Postgres row-level security policies on 17 tables — dispatch_shipments, dispatch_carriers, dispatch_invoices, crm_accounts, crm_contacts, crm_activities, and 11 KPI/aggregate views. Even raw pool.query(...) calls outside the request middleware cannot return cross-tenant data because app.current_tenant_id is set per connection.

Phase 2: Remaining operational tables (warehouse, vendor, factor) — Q3 work.

What changed: New-IP detection compares each login against a per-user IP whitelist. First time from a new location triggers an email alert with a signed session-revoke link. Rate limiters on /login, /signup, /otp, and /forgot-password log lockouts to a permanent security event log.

Security events are visible to admins in the God Mode panel.