Security & privacy
Scoped security self-assessment
We review selected application controls against OWASP’s Application Security Verification Standard (ASVS) 5.0.0 using source review and focused regression tests.
Current deployment revision for support: 1baa076e2940. This identifies the running build; it does not extend the dated source review.
Scope and method
Selected Nano Triage web application controls for browser sessions, OAuth sign-in, security headers, and bounded request parsing.
Manual source review and focused, repeatable automated regression tests. Each row names the evidence lane and the remaining boundary.
Selected ASVS controls
Secure cookie transport
HTTPS auth cookies use the __Secure- prefix and Secure, HttpOnly, SameSite=Lax, with the application path retained. Local HTTP development uses unprefixed cookies because browsers reject secure-only cookies over HTTP.
- Evidence
- Cookie-policy unit tests and the OAuth/session source regression in test:security.
- Boundary
- The final deployment's Set-Cookie headers and OAuth round trip have not been sampled in this report.
HTTP Strict Transport Security
The application configures HSTS in its response security-header set, and the application configuration wires that set into Next.js.
- Evidence
- The browser-security-header regression in test:security checks the HSTS policy and framework wiring.
- Boundary
- Live response headers, domain coverage, and hosting behavior are outside this source-and-test review.
OAuth request forgery protection
Google authorization uses a transaction-bound state value and S256 PKCE; the callback checks state and supplies the matching verifier.
- Evidence
- The OAuth/session source regression in test:security checks the start and callback paths.
- Boundary
- Provider-side client settings and the deployed Google OAuth round trip are outside this source-and-test review.
Bounded request validation
Selected security-sensitive JSON endpoints enforce byte limits before parsing; the shared bounded-body helper rejects declared and streamed overflow.
- Evidence
- The boundedRequestBody unit tests in test:commercial and endpoint-bound assertions in test:security.
- Boundary
- This is not a claim that every application input has been exhaustively validated against every business rule.
Content Security Policy
A restrictive CSP is configured, including frame-ancestors and object-src restrictions. The current policy still has inline-script/style and WebAssembly exceptions.
- Evidence
- The browser-security-header regression in test:security and the explicit residual-risk entry in the source threat model.
- Boundary
- The exceptions and live policy behavior require further review; this row is deliberately not marked complete.
Nano Triage data-flow check
Local image privacy boundary
Ordinary image preparation and OCR run in the browser. Managed visual processing requires a separate permission and is limited to selected encrypted frames.
Evidence: The privacy/security suites and the unified browser journey's request-boundary assertions.
Boundary: Local browser storage is not a secure enclave; successful same-origin compromise remains a residual risk.
Outside this report
- The full ASVS catalog or attainment of any ASVS level.
- Independent penetration testing or a third-party assurance opinion.
- Production hosting, secret scopes, live OAuth, database, payment, provider, logging, and backup/restore configuration.
- Physical-device, assistive-technology, and production traffic testing.