From ff70912e311dc50189d408312371e752b88cab57 Mon Sep 17 00:00:00 2001 From: Sean Starkey Date: Tue, 2 Jun 2026 10:29:58 -0600 Subject: [PATCH] Add security section. --- README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/README.md b/README.md index 5a150ee..eb051bd 100644 --- a/README.md +++ b/README.md @@ -61,6 +61,16 @@ JWT_SECRET=dev-secret-change-me-do-not-use-in-production mvn spring-boot:run - The service returns structured error responses for application-level failures so clients can handle validation, authentication, authorization, and conflict cases predictably. - This implementation favors clarity over extra infrastructure. Features such as refresh tokens, token revocation, audit logging, pagination, rate limiting, and OpenAPI generation would be good production follow-ups. +## Security considerations + +- Passwords are hashed with BCrypt before being persisted. Plaintext passwords are accepted only in registration/login request bodies and are never returned by the API. +- Authentication uses JWT bearer tokens. Protected endpoints require an `Authorization: Bearer ` header. +- The JWT signing secret is supplied through configuration. The local development value should not be used in production; production deployments should load it from an environment variable or secret manager. +- Access control is enforced in the service layer. Users can read and modify only their own notes unless a note has been explicitly shared with them. +- Shared notes are read-only for recipients. Only the owner can update, delete, or share a note. +- The API returns `404 Not Found` for another user's unshared note so callers cannot distinguish between a missing note and a note they are not allowed to see. +- Production deployments should run behind HTTPS, avoid logging credentials or tokens, and consider token expiration, rotation, revocation, rate limiting, and audit logging. + ## Testing The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally.