OWASP Top 10
How we address each OWASP Top 10 category through framework protections and additional controls
Approach
The SSM.ro platform uses a modern web framework with built-in protections against the main OWASP Top 10 categories. Additional controls at the application, platform, and dependency levels complete the coverage.
Protections per OWASP Category
| OWASP Category | Control(s) in Place |
|---|---|
| A01 Broken Access Control | RBAC enforced server-side on every request; tenant isolation at the database query level; subdomain verification; no authorization based solely on the UI |
| A02 Cryptographic Failures | TLS 1.2+ enforced on all traffic; encryption at rest on all components (Postgres, S3, Redis, CloudWatch); HSTS enabled |
| A03 Injection (SQL, etc.) | Parameterized database queries — no string concatenation in queries; user input never reaches SQL queries unprocessed |
| A04 Insecure Design | Architectural modeling with tenant isolation by design; signing with data minimization (typically only the document hash reaches the e-signature provider; the full document is sent only if the provider requires transmission of the complete document) |
| A05 Security Misconfiguration | Security headers configured application-wide: HSTS, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy; HTTPS enforced in production |
| A06 Vulnerable and Outdated Components | Static code analysis (SAST) and dependency SCA scanning run continuously; defined remediation SLAs (Critical 7 days, High 30 days) |
| A07 Identification and Authentication Failures | Account lockout after 10 failed attempts, with a counter shared between password and 2FA code; self-service unlocking via an email link; session timeout (30 min of inactivity; “remember me” suspends expiry for 2 weeks); authentication auditing; password policy (8–128 characters); password reset link valid for 6 hours; the recovery and unlock forms do not confirm whether an account exists (anti-enumeration); optional TOTP 2FA (code from an authenticator app or sent by email), which the organization can enforce — see Local Authentication and 2FA |
| A08 Software and Data Integrity Failures | GitHub branch protection (mandatory PR review on main); versioned Heroku releases with rollback; static analysis on every build |
| A09 Security Logging and Monitoring Failures | New Relic APM + alerts on error rates; Sentry runtime exception monitoring; CloudWatch Logs for signing audit trail (5 years); client activity logs in Postgres (3 months) |
| A10 Server-Side Request Forgery (SSRF) | CSRF token verification on any state-changing request; automatic HTML output escaping (XSS) |
Additional Perimeter Controls
Enterprise (Dedicated) Model
In the AWS infrastructure dedicated per client, an optional AWS-managed perimeter control is available:
- AWS WAF — Web Application Firewall in front of the application, with managed rules (including OWASP Top 10 / common rule sets), rate limiting, and request-level filtering
This service is activated on request, depending on the client's security requirements.
XSS (Cross-Site Scripting)
Automatic HTML escaping — the platform's templating system automatically escapes all HTML output, preventing script injection from user data.
CSRF (Cross-Site Request Forgery)
CSRF token verified on any state-changing request — the token is automatically generated and validated by the framework. A request without a valid token is rejected.
File Upload
Uploaded files are validated at multiple levels:
- Only allowed file extensions (whitelist)
- File size limits enforced
- MIME type verification for sensitive uploads
This prevents the upload of malicious files or unexpected file types.
Input Validation
User input is explicitly validated and filtered (allow-listed) before being used in database operations, preventing parameter tampering and other forms of injection.