# AkDevz AI Market Intelligence — Security & Safeguards Policy

Author: Security Architecture Lead  
Version: 1.0.0  
Status: Enforced

---

## 1. Absolute Structural Safeguard: Zero Broker Order Execution

The single most fundamental security control of this platform is structural:
> **The platform codebase contains ZERO endpoints, functions, SDK calls, or database tables capable of placing, modifying, cancelling, or executing live broker orders.**

No matter what data arrives, what prompt is processed, or what AI output is generated, the application cannot financially impact user brokerage balances directly.

---

## 2. Broker Credential & OAuth Token Protection

1. **At-Rest Encryption**: FYERS `secret_key` and daily `access_token` are stored in the database encrypted via **AES-256-GCM** using PHP's OpenSSL extension (`openssl_encrypt`). The encryption key is sourced strictly from `APP_SECRET_KEY` in `.env` outside the web root.
2. **Zero Frontend Transmission**:
   - Access tokens and secrets are never embedded in HTML markup.
   - API endpoints serving client JavaScript return only sanitized data models and connection health statuses (`CONNECTED`, `EXPIRED`, `UNCONFIGURED`).
   - Browser developer consoles and network traces reveal zero credentials.
3. **AI Prompt Redaction**: The Gemini AI integration pipeline scrubs all API keys, client IDs, IP addresses, and user identifiers before transmitting serialized evidence packages.
4. **Daily Expiry Alignment**: Tokens naturally expire daily at 06:30 AM IST per FYERS protocol. The platform honors this lifecycle without creating unauthorized refresh mechanisms.

---

## 3. Web Application Security Architecture

### A. SQL Injection Prevention
- All database queries are executed via **PDO prepared statements** with strict parameterized inputs.
- Dynamic table names or raw SQL string concatenation are prohibited.

### B. Cross-Site Scripting (XSS)
- All user-supplied inputs and dynamic market strings are filtered through `htmlspecialchars($string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')` before DOM rendering.
- Modern Content Security Policy (CSP) headers are dispatched by PHP middleware.

### C. Cross-Site Request Forgery (CSRF)
- All state-changing POST/PUT requests require a valid cryptographic CSRF token stored in the user's session (`$_SESSION['csrf_token']`).
- Tokens are verified via `hash_equals()` to prevent timing attacks.

### D. Session Security & Fixation Protection
- Sessions are initialized with secure cookies:
  ```php
  ini_set('session.cookie_httponly', 1);
  ini_set('session.cookie_samesite', 'Lax');
  ini_set('session.use_only_cookies', 1);
  ```
- Session IDs are regenerated (`session_regenerate_id(true)`) upon authentication, privilege elevation, and periodic 30-minute intervals.

### E. Server Hardening & cPanel Compliance
- Storage directories (`storage/logs`, `storage/cache`, `storage/private`) and application logic (`app/`, `python/`, `database/`) reside above or outside the public web root (`public/`).
- Directory listing is disabled via `.htaccess` in `public/`.