UEDF Sentinel v5.0
Structural Security Audit

// Login form pre-filled with production credentials
<input type="text" name="username" value="commander" />
<input type="password" name="password" value="commander123" />

<input type="text" name="username" placeholder="Username" />
<input type="password" name="password" placeholder="Password" />
// Credentials injected only via environment variables

define('SENTINEL_API_KEY', 'uedf-sentinel-mobile-2026');
define('DB_PASS',         'sentinel_prod_pass');
// Rotation requires a code push and deployment — key lives in git history

define('SENTINEL_API_KEY', $_ENV['SENTINEL_API_KEY']
    ?? throw new \RuntimeException('SENTINEL_API_KEY not set'));
define('DB_PASS', $_ENV['DB_PASSWORD']
    ?? throw new \RuntimeException('DB_PASSWORD not set'));
// Rotation: update env var in deployment config, restart process. Zero code change.

header('Access-Control-Allow-Origin: *');

// Allowlist from environment variable
$allowed = array_filter(explode(',', $_ENV['SENTINEL_CORS_ORIGINS'] ?? ''));
$origin  = $_SERVER['HTTP_ORIGIN'] ?? '';
if (in_array($origin, $allowed, true)) {
    header('Access-Control-Allow-Origin: ' . $origin);
    header('Vary: Origin');
}

session_start();
// ... validate username + password ...
// Session ID never rotated — attacker who fixed the ID before login now owns the session
$_SESSION['user_id'] = $user->id;
$_SESSION['role']    = $user->role;

session_start();
// ... validate username + password ...
session_regenerate_id(true);  // destroys old session data, issues new SID
$_SESSION['user_id'] = $user->id;
$_SESSION['role']    = $user->role;

if ($attempts > MAX_LOGIN_ATTEMPTS) { lockout(); }
// MAX=5 → 6th attempt NOT blocked (> 5 is false when attempts=5)

if ($attempts >= MAX_LOGIN_ATTEMPTS) { lockout(); }
// MAX=5 → 6th attempt blocked (>= 5 is true when attempts=5)

header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With');
// No X-Content-Type-Options, X-Frame-Options, CSP, HSTS, or Referrer-Policy

// ... CORS allowlist (see F-03) ...

// Defence-in-depth headers on every API response
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('Content-Security-Policy: default-src \'self\'');
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
header('Referrer-Policy: no-referrer');
header('X-Permitted-Cross-Domain-Policies: none');

// Feature Flags
'websocket' => true,
'debug' => true,
'maintenance' => false,
// PHP renders exceptions, stack traces, and file paths directly to the HTTP response

// Feature Flags
'websocket' => true,
'debug' => false,  // Never expose errors to users in production; use error_log instead
'maintenance' => false,

// SQL built by string concatenation — classic injection surface
$id     = $_GET['id'];
$result = $db->query("SELECT * FROM missions WHERE id=" . $id);
// Payload: ?id=1 OR 1=1 — returns all missions regardless of RBAC

$stmt = $db->prepare("SELECT * FROM missions WHERE id = ? AND user_id = ?");
$stmt->execute([$_GET['id'], $_SESSION['user_id']]);
// Parameter binding prevents injection. user_id check enforces RBAC at query level.
$result = $stmt->fetchAll(PDO::FETCH_ASSOC);

function logActivity($user_id, $action, $details = '') {
    try {
        $pdo = new PDO('mysql:host=localhost;dbname=uedf_sentinel', 'root', '');
        // Hardcoded localhost + empty password — silently used if env vars are absent

function logActivity($user_id, $action, $details = '') {
    try {
        $dbHost = $_ENV['DB_HOST'] ?? throw new \RuntimeException('DB_HOST not set');
        $dbName = $_ENV['DB_NAME'] ?? throw new \RuntimeException('DB_NAME not set');
        $dbUser = $_ENV['DB_USER'] ?? throw new \RuntimeException('DB_USER not set');
        $dbPass = $_ENV['DB_PASS'] ?? throw new \RuntimeException('DB_PASS not set');
        $pdo = new PDO("mysql:host={$dbHost};dbname={$dbName}", $dbUser, $dbPass);
        // Missing env var throws immediately — no silent misconfiguration possible

# .github/workflows/security.yml
- name: No hardcoded credentials
  run: |
    ! grep -rn \
      "commander123\|uedf-sentinel-mobile\|sentinel_prod_pass" \
      --include="*.php" .

- name: Auth check present on all controllers
  run: |
    for f in src/Controllers/*.php; do
      grep -q "Auth::requireLogin\|session_start" "$f" || \
        { echo "MISSING auth: $f"; exit 1; }
    done

- name: No string-concatenated SQL
  run: |
    ! grep -rn 'query(.*\$_GET\|query(.*\$_POST\|query(.*\$_REQUEST' \
      --include="*.php" .