Security Audits & Checks
Relevant source files
The following files were used as context for generating this wiki page:
The IT Management System employs a multi-layered approach to security, combining static code analysis, runtime testing, and automated audit logging to protect multi-tenant infrastructure. The primary goal of these security checks is to ensure that every data-mutating action is guarded by Cross-Site Request Forgery (CSRF) tokens and that database interactions are safe from SQL injection (SQLi) vulnerabilities.
Security audits are integrated into the development lifecycle via the scripts/ directory, providing both Browser-based HTML reports for developers and CLI-based tools for Continuous Integration (CI) pipelines. This ensures that the system maintains its "Zero Dependencies" architecture while providing robust protection for sensitive IT asset data.
Sources: wiki/Security.md:1-10, scripts/scripts.php:111-120, README.md:215-225, scripts/AGENT_NOTES.md:5-15
Static Analysis & Coverage Scanners
The project utilizes specialized PHP scripts to scan the codebase for security gaps. These scanners identify POST handlers lacking CSRF protection and detect direct SQL queries that do not use prepared statements or binding.
CSRF Coverage Audit
The check_csrf_coverage.php script performs a static scan of the repository to identify POST handlers that mutate data without a known CSRF guard. This is a mandatory check after making any changes to CRUD (Create, Read, Update, Delete) modules.
Sources: scripts/scripts.php:330-335, wiki/Security.md:5-8, README.md:218-220
SQL Injection Coverage Audit
The check_sql_injection_coverage.php script scans for direct SQL queries located near user input variables where binding or sanitization is not evident. It ensures that the system adheres to the project requirement of using mysqli prepared statements for all database interactions.
Sources: scripts/scripts.php:345-350, wiki/Security.md:5-8, scripts/AGENT_NOTES.md:10-15
Multi-Tenant Isolation Audit
A dedicated script, check_multi_tenant_leaks.php, audits SQL queries and INSERT statements to ensure they include mandatory company_id filters. It also checks the UI to prevent the improper exposure of internal company identifiers.
Sources: scripts/scripts.php:351-356, scripts/AGENT_NOTES.md:30-35
Runtime Testing & Interactive Tools
In addition to static analysis, the system provides interactive sandboxes and regression tests to verify security controls in a live environment.
SQL Injection Sandbox
The scripts/test_sql_injection.php endpoint serves as a JSON sandbox. It allows developers to test SQL injection signature detection and verify the safe execution of prepared statements under various GET and POST payloads. This endpoint requires an active session and a valid company_id.
Sources: scripts/scripts.php:131-140, scripts/api.php:111
Authentication & Session Bypassing
For development and automated testing (such as screenshot capture or Playwright regressions), the bypass_login.php CLI utility allows developers to establish an authenticated Admin session directly in the database.
The script also automatically adjusts session file permissions (0644) to ensure the web server can read sessions created in a CLI context.
Sources: scripts/scripts.php:403-408, scripts/AGENT_NOTES.md:45-65
Audit Logging System
The system maintains a traceable history of all data mutations. This is verified by the check_audit_logs_coverage.php script, which ensures that queries utilize itm_run_query, itm_log_audit, or database triggers (trg_{table}_audit_*).
Security Audit Components
| Tool | Access Mode | Primary Function |
|---|---|---|
smoke_test.sh | CLI-only | Orchestrates linting, CSRF, and SQLi scans in CI. |
check_audit_logs_coverage.php | Browser/CLI | Audits the presence of audit trail logging for mutations. |
repro_vulnerabilities.php | Browser/CLI | Verification script for Explorer RCE and Privilege Escalation. |
sql_injection_matrix_test.php | Browser/CLI | Tests lib/sql_injection_detector.php against fixed payload matrices. |
Sources: scripts/scripts.php:323-328, scripts/scripts.php:376-385, scripts/scripts.php:394-399, scripts/scripts.php:447-452
Data Mutation & QA Runners
The module_browser_qa_runner.php script executes full-module QA across all entries (modules 1–5). This flow tests the entire security lifecycle of a module, including data clearing, sample seeding, and error log rotation.
The QA runner also triggers a cleanup utility, module_clean_tests_qa_runner.php, to remove temporary artifacts, test companies, and orphan folders created during the audit.
Sources: scripts/scripts.php:418-435, scripts/verify_api_coverage.php:1-15
Implementation Standards
To maintain security, developers must adhere to the following implementation patterns:
- CSRF Tokens: Must be present in the
csrf_tokenbody parameter orX-CSRF-Tokenheader for all POST requests. - Prepared Statements: Use
mysqli::prepareandbind_param. Direct concatenation of user input into SQL strings is prohibited. - Tenant Scoping: The
company_idmust never be sent in API payloads from the client; it is resolved server-side from the authenticated session. - Secret Management: Secrets must be moved out of
config/config.phpand into environment variables or a server-local.envfile.
Sources: scripts/api.php:164-180, README.md:255-265, scripts/AGENT_NOTES.md:20-25
The security audit framework ensures that the IT Management System remains resilient against common web vulnerabilities while providing developers with the tools necessary to verify compliance with multi-tenant isolation and data integrity rules.