Security & compliance

All changes audited · step-up auth required for edits

Platform hardening in one place: traffic protection, HTTP security posture, supply-chain pipeline, release quality gates, and the versioned legal documents every tenant must accept.

Rate limiting & DoS Headers & CORS Supply chain Release quality Legal documents Audit-data compliance

Rate limiting & DoS protection · adaptive level: NORMAL (1.0×)

Dimension	Window	Top consumer right now	State
Per IP (unauthenticated)	60 s	193.14.22.8 · 171 req	● OK	✎ edit
Per user (authenticated)	60 s	user 8102 · 44 req	● OK	✎ edit
Per tenant (aggregate)	60 s	SWE federation · 2 130 req	● OK	✎ edit
Login attempts (per IP)	exponential	3 IPs in lockout	● Watch	✎ edit

Adaptive control: at 2× baseline traffic limits tighten to 0.5×, at 5× to 0.25×. 429 responses carry Retry-After + X-RateLimit-* headers. Health checks exempt.

Exponential per-IP backoff 1s → 30s on failed logins. 3 IPs currently locked out.

CAPTCHA required after N failures

Cloudflare origin protection

Real client IP from CF-Connecting-IP. Direct-to-origin requests without the CF header → 403.

● Enforced in production

Turnstile bot protection

All public POST endpoints (auth, signup, contact, feature requests) + honeypot. Fails open after 5 s CF timeout.

● 14 endpoints covered

Security headers & CORS

Header	Value	Note
Content-Security-Policy	script-src 'self' 'nonce-…'	per-request nonce · frame-ancestors none
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload	HSTS preload list
X-Frame-Options	DENY	clickjacking protection on admin + API
Referrer-Policy	strict-origin	stricter than platform default
Permissions-Policy	camera=(), microphone=(), geolocation=() …	fullscreen/PiP allowed same-origin

CORS allowlist · per environment

Environment

Wildcard origins rejected in production (validated at boot).

SRI asset registry (CDN integrity)

3 registered assets · sha384 · public manifest served to apps.

fonts.css✓ verified 2026-07-01

turnstile-widget.js✓ verified 2026-07-01

maps-embed.js✓ verified 2026-06-28

security.txt (RFC 9116)

Served on all public domains · PGP key + disclosure policy (en/sv/fr/es) + hall of fame. Weekly CI check on the Expires field.

Expires2026-12-31 · ✓ 182 days left

Supply-chain security pipeline (four layers)

Layer	Tool & cadence	Current findings	State
Dependency updates	Dependabot (weekly)	4 open PRs (all minor, grouped)	● Green
Secret scanning	Gitleaks (every PR + push)	0 findings · custom Stripe/Azure/JWT rules	● Green
Static analysis	CodeQL (PR + weekly)	1 medium alert (open 3 d)	● Attention
Container image scan	Trivy (pre-deploy gate)	CRITICAL/HIGH with fix → deploy blocked	● Green

SECURITY_OVERRIDE exception on a blocked deploy notifies #ops-alerts automatically and requires a documented accepted-risk entry.

CVE remediation SLA

Critical	48 hours	retro required
High	7 days	—
Medium	30 days	—
Low	best effort	—

Responsible disclosure

Public SECURITY.md with scope, SLA and contact (security@petanque.life). Accepted-risks register: 2 entries, both reviewed Q2.

Release quality gates

Gate	Target	Current	State
API line coverage (required check)	≥ 80 %	84.2 %	● Pass
Critical-path suite (billing + GDPR)	7 flows green	7 / 7	● Pass
Frontend coverage (soft gate)	informational	61 %	● Pass
Visual regression (3 browsers × 3 viewports)	≤ 0.1 % pixel diff	0.00 %	● Pass
Lighthouse (12 admin routes × 2 form factors)	floor 90 · regression ≤ 5	min 93	● Pass
i18n coverage (Tier-1 strings)	≥ 80 %	91 %	● Pass

Baseline updates require an explicit accept marker in the commit message — visual drift never lands silently.

Legal documents · versioned per (type, language)

Document	Languages	Active version	Effective	Supersedes
Terms of Service	EN / SV / FR / ES	v4	2026-05-01	v3 (auto-superseded)	History
Data Processing Agreement	EN / SV	v3	2026-03-15	v2	History
Billing Terms	EN	v2	2026-01-01	v1	History
SLA	EN	v2	2026-01-01	v1	History

SHA-256 content hash per version · publishing auto-supersedes the previous active version and can require tenant re-acceptance.

Tenant acceptance register (append-only audit)

Tenant	Documents	Version	Method	Evidence
Svenska Bouleförbundet	ToS + DPA + Billing + SLA	current	BankID (SE default)	2026-05-02 · IP + UA + hash logged
Norges Bouleforbund	ToS + DPA	current	Clickwrap	2026-05-11
Dansk Pétanque Forbund	ToS v3 (stale)	re-acceptance pending	DocuSign envelope sent	reminder 2026-07-01

Onboarding guard: tenant creation is blocked (422 with the missing-documents checklist) until every required document is accepted. Signed PDFs get an attestation page (signer, timestamp, hash, provider ref) in archival PDF/A format.

● Clickwrap · live ● DocuSign (JWT grant) · live ● BankID v6 (SE default) · live

Audit-data compliance

Retention policy

Audit log retention: indefinite (legal basis GDPR art. 6(1)(f)). No TTL indexes anywhere. Non-compliant tenant policies are flagged automatically.

Per-field PII classification

Every audit field tagged: identity / network / behavioural / contextual. Erasure anonymises PII in place (actor → null, IP → 0.0.0.0) — the record itself is never deleted. Machine-readable schema exposed to the DPO tools.

States

⏳ Loading security posture…

✓ All gates green — no findings need attention.

⚠ Could not reach the pipeline API — showing last known state (14:02 UTC).