Security

This section covers the security architecture and features of the SLOzy platform.

Contents

• Security Overview — Architecture, JWT auth, RBAC, rate limiting, security headers, CORS, Prometheus TLS
• Authentication — JWT access and refresh tokens, password reset flow, OAuth2, audit logging
• Authorization — RBAC roles, permissions, API keys, resource-level access control

Security Features at a Glance

Feature	Implementation	Location
Authentication	JWT (HS256) with access + refresh tokens	internal/auth/service.go
Authorization	Role-Based Access Control (RBAC)	internal/rbac/service.go
Rate Limiting	Token bucket algorithm	internal/middleware/security.go
Security Headers	CSP, HSTS, X-Frame-Options, etc.	internal/middleware/security.go
CORS	Configurable allowed origins	internal/middleware/security.go
Password Hashing	bcrypt	internal/auth/service.go
Audit Logging	Database-persisted audit trail	migrations/000006_slo_audit_log
API Keys	Hashed key storage with scopes	migrations/000015_rbac_system
OAuth2	GitHub, Google provider support	migrations/000013_oauth2_persistence

Quick Security Checklist

• [ ] Change the default JWT_SECRET to a strong, random value (min 32 characters)
• [ ] Enable HTTPS with valid TLS certificates
• [ ] Configure CORS origins to your domain only
• [ ] Set appropriate rate limits for your traffic profile
• [ ] Enable Prometheus TLS (InsecureSkipVerify: false)
• [ ] Review RBAC role assignments regularly
• [ ] Rotate API keys periodically
• [ ] Enable audit logging for compliance tracking