the_inventory

Security Guide

Overview

The Inventory is built with security as a core principle. This guide covers security features, best practices, and how to report vulnerabilities.

Security Features

Authentication

JWT (JSON Web Tokens)

Password Security

Multi-Factor Authentication (MFA)

See API Reference - Authentication for implementation details.

Authorization

Role-Based Access Control (RBAC)

Tenant Isolation

Permission Levels

Data Protection

Encryption in Transit

Encryption at Rest

Data Isolation

Input Validation

Request Validation

SQL Injection Prevention

XSS Prevention

CSRF Protection

Cross-Site Request Forgery

Rate Limiting

API Rate Limiting

Brute Force Protection

Audit Trails

Complete Audit Logging

Access Logging

Best Practices

For Administrators

1. Environment Configuration

Production Environment:

# .env
DEBUG=False
ALLOWED_HOSTS=api.example.com
SECRET_KEY=<strong-random-key>
SECURE_SSL_REDIRECT=True
SESSION_COOKIE_SECURE=True
CSRF_COOKIE_SECURE=True
SECURE_HSTS_SECONDS=31536000

Never:

2. User Management

Strong Passwords

Account Security

Principle of Least Privilege

3. API Security

CORS Configuration

# Only allow trusted origins
CORS_ALLOWED_ORIGINS = [
    "https://app.example.com",
    "https://admin.example.com",
]

API Keys

Rate Limiting

4. Database Security

Access Control

Backups

Monitoring

5. Infrastructure Security

Server Hardening

Network Security

Monitoring & Logging

For Developers

1. Secure Coding

Input Validation

# ✅ Good: Validate all inputs
from rest_framework import serializers

class ProductSerializer(serializers.ModelSerializer):
    class Meta:
        model = Product
        fields = ['name', 'sku', 'price']
    
    def validate_price(self, value):
        if value < 0:
            raise serializers.ValidationError("Price must be positive")
        return value

# ❌ Bad: No validation
def create_product(request):
    name = request.GET.get('name')  # No validation!
    Product.objects.create(name=name)

Parameterized Queries

# ✅ Good: Use ORM
products = Product.objects.filter(name=search_term)

# ❌ Bad: Raw SQL
products = Product.objects.raw(f"SELECT * FROM products WHERE name = '{search_term}'")

Error Handling

# ✅ Good: Generic error messages
try:
    user = User.objects.get(email=email)
except User.DoesNotExist:
    raise serializers.ValidationError("Invalid credentials")

# ❌ Bad: Revealing error messages
try:
    user = User.objects.get(email=email)
except User.DoesNotExist:
    raise serializers.ValidationError(f"User {email} not found")

2. Authentication & Authorization

Protect Endpoints

# ✅ Good: Require authentication
from rest_framework.permissions import IsAuthenticated

class ProductViewSet(viewsets.ModelViewSet):
    permission_classes = [IsAuthenticated]
    
    def get_queryset(self):
        # Only return user's tenant data
        return Product.objects.filter(tenant=self.request.user.tenant)

# ❌ Bad: No authentication
class ProductViewSet(viewsets.ModelViewSet):
    # Anyone can access!
    pass

Tenant Isolation

# ✅ Good: Filter by tenant
def get_queryset(self):
    return Product.objects.filter(tenant=self.request.user.tenant)

# ❌ Bad: No tenant filtering
def get_queryset(self):
    return Product.objects.all()  # All tenants!

3. Dependency Management

Keep Dependencies Updated

# Check for vulnerabilities
pip install safety
safety check

# Update dependencies
pip install --upgrade -r requirements.txt

Use Pinned Versions

# ✅ Good: Pinned versions
Django==4.2.0
djangorestframework==3.14.0

# ❌ Bad: Open ranges
Django>=4.0
djangorestframework>=3.0

4. Secrets Management

Never Commit Secrets

# ✅ Good: Use environment variables
SECRET_KEY = os.environ.get('SECRET_KEY')

# ❌ Bad: Hardcoded secrets
SECRET_KEY = 'my-secret-key-12345'

Use .env Files

# .env (never commit)
SECRET_KEY=<strong-random-key>
DATABASE_URL=postgres://user:pass@localhost/db
API_KEY=<api-key>

# .env.example (commit this)
SECRET_KEY=<change-me>
DATABASE_URL=postgres://user:pass@localhost/db
API_KEY=<change-me>

5. Testing Security

Test Authentication

def test_unauthenticated_access_denied():
    response = client.get('/api/products/')
    assert response.status_code == 401

def test_authenticated_access_allowed():
    client.force_authenticate(user=user)
    response = client.get('/api/products/')
    assert response.status_code == 200

Test Authorization

def test_user_cannot_access_other_tenant():
    user1 = create_user(tenant=tenant1)
    user2 = create_user(tenant=tenant2)
    
    client.force_authenticate(user=user1)
    response = client.get(f'/api/products/{user2_product.id}/')
    assert response.status_code == 403

Test Input Validation

def test_invalid_price_rejected():
    response = client.post('/api/products/', {
        'name': 'Product',
        'price': -10  # Invalid!
    })
    assert response.status_code == 400

Vulnerability Management

Reporting Vulnerabilities

Responsible Disclosure

If you discover a security vulnerability, please report it responsibly:

  1. Do NOT create a public GitHub issue
  2. Do NOT post on social media
  3. Do NOT share details publicly

Report To:

Include:

Response Timeline:

Security Updates

Staying Updated

Applying Updates

# Check for security updates
pip install --upgrade pip
pip list --outdated

# Update dependencies
pip install --upgrade -r requirements.txt

# Run tests
pytest

# Deploy to production
# (See Deployment Guide)

Data Protection

Personal Data

Data Collection

Data Retention

Data Sharing

Compliance

GDPR (General Data Protection Regulation)

CCPA (California Consumer Privacy Act)

HIPAA (Health Insurance Portability and Accountability Act)

Security Checklist

Before Deployment

Regular Maintenance

Incident Response

If a Security Incident Occurs:

  1. Assess the Situation
    • What was compromised?
    • How did it happen?
    • Who has access?
  2. Contain the Incident
    • Disable affected accounts
    • Revoke compromised tokens
    • Block suspicious IPs
    • Isolate affected systems
  3. Investigate
    • Review logs
    • Identify root cause
    • Determine scope
    • Document findings
  4. Remediate
    • Fix the vulnerability
    • Apply patches
    • Update security controls
    • Test fixes
  5. Communicate
    • Notify affected users
    • Provide guidance
    • Offer support
    • Be transparent
  6. Learn
    • Post-incident review
    • Update procedures
    • Improve monitoring
    • Share lessons learned

Security Resources

Internal Documentation

External Resources

Tools

Questions?

For security questions or concerns:

  1. Check this guide
  2. Review API Reference - Authentication
  3. Check Troubleshooting Guide
  4. Create a GitHub Discussion
  5. Contact security team (security@example.com)

Security is everyone’s responsibility. Thank you for helping keep The Inventory secure! 🔒

This site is open source. Improve this page.