# Security

Zod validates external data. Prisma parameterizes SQL. Helmet adds browser security
headers, CORS is allowlisted, payload size is limited, secrets are redacted from
logs and access is tenant-scoped. Audit records have no update/delete application
route. Rotate every secret and the supplied database password before production,
and use TLS for database, Redis and public endpoints.