Application Security
- Helmet.js security headers on all API responses
- CORS policies restricting cross-origin requests
- Input validation and sanitisation on all endpoints
- Rate limiting to prevent brute force and DDoS attacks
- SQL injection protection via Prisma ORM parameterised queries
- Secure webhook verification for WhatsApp Business API callbacks
- Role-based access control (Owner, Admin, Agent)
- API key scoping — each integration uses least-privilege access