H2 — Add session maxAge: 28800 (8h) to auth.config.ts

v4 Audit H2. NextAuth defaults to 30-day JWT lifetime. MSP admin tool must have max 8h session (SOC2 CC6.4). One-liner fix in auth.config.ts.

H1 — Fix JWT role refresh (remove if (user) guard in auth.ts)

v4 Audit H1. syncTechPermissions runs only at sign-in. Permission revocations take up to 30 days to take effect. Remove the guard or set short maxAge (H2 covers this).

H4/H5/H6 — Add ADMIN role check on 3 analytics routes

v4 Audit H4-H6. analytics/health-overview, analytics/licenses, analytics/task-runs expose all-tenant data to any authenticated user. Add hasMinRole(role, 'ADMIN') after session guard.

H7 — Rate Limiting (Upstash Ratelimit) — v4 Audit confirmed absent

v4 Audit H7. Still no rate limiting in package.json. Install @upstash/ratelimit + @upstash/redis. Apply to /api/webhooks/n8n (20/min), /api/tech/tasks/run (10/min/user), auth routes.

H3/H8 — Timing-safe webhook + task permission fix

H3: Replace === with crypto.timingSafeEqual() on N8N_CALLBACK_SECRET. H8: Deny-by-default when taskPermissions.length === 0 in tech/tasks/run (empty perms = block, not allow-all).

M17 — AuditLog GDPR FK + M18 Retention Policy

M17: Add tenantId FK to AuditLog (onDelete: SetNull) — enables GDPR erasure. M18: Add /api/cron/prune-audit-logs monthly cron (7yr retention threshold). Both confirmed missing in v4 audit.

L5 — CSP Nonce-based (unsafe-inline/unsafe-eval removal)

TODO comment in next.config.ts. Full nonce-based CSP requires proxy.ts nonce injection. Deferred (v4 confirmed LOW).

Configure AdAgentId for Remaining Tenants

Only KTC configured. Need agent IDs from remaining 14 tenants for AD operations.

Rotate Azure AD Credentials

AUTH_MICROSOFT_ENTRA_ID_SECRET + GRAPH_CLIENT_SECRET were exposed in git history before purge.

⛔ Requires Azure Portal access. Secrets must be rotated manually by tenant admin.

Security Fixes v7 — 30/30 findings remediados (3C·9H·13M·5L)

Security Audit v7 — 3C·9H·13M·5L (30 findings, −36 vs v6)

Security Fixes — 21 findings remediated (v5 report)

Security Audit v5 + ISO 27001:2022 Baseline

H4/H5 — syncTechPermissions Defensivo + Zod Validation (13 rutas)

Security Fixes Wave 1+2 — 16 Findings Remediated (v4 Audit)

Security Audit v4 — 0 CRITICAL, 8 HIGH, 18 MEDIUM, 6 LOW

Error Boundaries + Stability Fixes

N8N Webhook Receiver → SystemAlerts

Task Run SSE + Notifications + SystemAlert on Failure

HIGH H2–H4 + M6 — RBAC Admin Route Checks

M1–M5 + L1–L3 — Zod, Sanitización, Hygiene

CRITICAL — Fix Sophos IDOR C1–C7 + /endpoints

CRITICAL — Fix NinjaOne IDOR C8–C11

CRITICAL C12 + HIGH H5–H6 — Zod + EDITOR role checks

DB Migration Neon → Supabase

Phase 1 — Secrets via Vercel Env Vars

Security Audit Report

IDOR Fix — NinjaOne Device Routes

HTTP Security Headers

RBAC Consistency (hasMinRole)

Middleware JWT Validation

AD Integration + Sync

AD Group Management

Run Task Feature (n8n webhook)

User Detail Panel + Page

Microsoft SSO Auth

Multi-tenant Graph API

NinjaOne RMM Integration

Sophos Central Integration

GitHub Actions Deploy (Vercel)

SentinelAgent API Client

AdGroupMember String Keys Migration

console.log Security Cleanup

Code Cleanup — 0 TS errors

Full Code Review — Dead Code & Git Hygiene