This document outlines security considerations for the eSolia Codex platform.

Codex handles content with varying sensitivity levels. Security controls are applied proportionally based on content classification.

• Primary Auth: Cloudflare Access (Zero Trust)
• Session: JWT with organization binding
• MFA: Required for confidential/embargoed content access

Shareable previews use token-based authentication:

https://codex.esolia.pro/preview/{token}

Token validation includes:

• Expiration check (configurable per sensitivity level)
• View count limit
• Optional IP allowlist
• Audit logging of all access attempts

• Workers receive requests through Cloudflare Access
• API tokens for CI/CD with minimal scope
• No service accounts with broad permissions

Standard content with no special handling:

• Blog posts, general help articles
• Public documentation
• Marketing materials

Business-sensitive content requiring approval:

• Client-specific documentation
• Internal procedures
• Pre-release feature documentation

Additional Controls:

• Preview sharing requires manager approval
• Encrypted at rest in D1
• Shorter token expiry (24 hours)
• Limited view count (10 max)

Time-sensitive content with strict controls:

• Acquisition announcements
• Earnings data
• Regulatory filings

Additional Controls:

• No preview until embargo lifts (or explicit override)
• Encrypted at rest
• Very short token expiry (4 hours)
• Minimal view count (3 max)
• IP restriction required
• Real-time alerts on access

Confidential and embargoed content receives additional application-layer encryption:

// Content encrypted before D1 storage
const encrypted = await crypto.subtle.encrypt(
  { name: 'AES-GCM', iv },
  key,
  content
);

• Cloudflare Access for all admin routes
• Organization-scoped queries (tenant isolation)
• Role-based permissions in D1
• Preview tokens with strict validation

• TLS 1.3 for all connections
• AES-256-GCM for sensitive content
• No sensitive data in URLs
• Secure token generation (crypto.randomUUID)

• Parameterized D1 queries (prepared statements)
• Input validation with Zod schemas
• Output encoding for HTML (regex-based sanitization, Workers-compatible)
• CSP headers on all responses

• Defense in depth (multiple security layers)
• Content classification from creation
• Approval workflows for sensitive content
• Regular security reviews

• Cloudflare-managed infrastructure
• Minimal permissions on API tokens
• Security headers on all responses
• Regular configuration audits

• Dependabot for dependency updates
• npm audit in CI/CD
• Minimal dependencies
• Regular security patches

• Cloudflare Access (no custom auth)
• Token expiration enforcement
• No password storage
• Session invalidation on logout

• Content versioning in D1
• Audit logging for all changes
• Preview token validation
• CI/CD pipeline integrity

• Comprehensive audit logging
• Real-time alerts for embargoed access
• Log aggregation (Cloudflare Logs)
• Anomaly detection (future)

• No user-controlled external requests
• R2 bucket access through Workers only
• Validated URL patterns for media
• No open redirects

All responses include:

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 0
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Preview pages add:

X-Robots-Tag: noindex, nofollow, noarchive, nosnippet
Cache-Control: private, no-store, no-cache, must-revalidate

Proposals and client-specific documents require additional security considerations.

flowchart TB
    subgraph DRAFT["📝 DRAFT PHASE"]
        D1["Stored in D1<br/>(encrypted for confidential)"]
        D2["Accessible only to<br/>assigned authors"]
        D3["Fragment refs resolved<br/>at view time"]
        D4["Auto-save with<br/>version history"]
    end

    subgraph REVIEW["👀 REVIEW PHASE"]
        R1["Preview links with<br/>restricted access"]
        R2["Watermarked with<br/>reviewer identity"]
        R3["Comments stored separately<br/>(never in PDF)"]
        R4["Approval workflow<br/>before export"]
    end

    subgraph EXPORT["📄 EXPORT PHASE"]
        E1["Fragments baked in<br/>(snapshot)"]
        E2["Provenance metadata<br/>embedded in PDF"]
        E3["Export logged with<br/>recipient info"]
        E4["PDF watermarked<br/>if confidential"]
    end

    subgraph DELIVERY["🔒 DELIVERY (Courier)"]
        L1["PIN-protected access"]
        L2["View tracking<br/>and limits"]
        L3["Expiring links<br/>(7 days default)"]
        L4["Download audit trail"]
    end

    DRAFT --> REVIEW
    REVIEW --> EXPORT
    EXPORT --> DELIVERY

    style DRAFT fill:#fef3c7,stroke:#f59e0b
    style REVIEW fill:#dbeafe,stroke:#3b82f6
    style EXPORT fill:#d1fae5,stroke:#10b981
    style DELIVERY fill:#fce7f3,stroke:#ec4899

Fragments are reusable content blocks that may contain sensitive information:

Fragment Access Rules:

• Fragments inherit sensitivity from their classification
• Confidential fragments require explicit grant to reference
• Fragment usage is logged in provenance metadata
• Updates to fragments trigger review of referencing documents

Every assembled document includes provenance metadata:

provenance:
  document_id: "proposal-acme-2025-01"
  created: "2025-01-15T10:30:00Z"
  created_by: "rick.cogley@esolia.co.jp"
  modified: "2025-01-20T14:45:00Z"
  modified_by: "rick.cogley@esolia.co.jp"
  exported: "2025-01-20T15:00:00Z"
  exported_by: "rick.cogley@esolia.co.jp"

  fragments_used:
    - id: "products/m365-business-premium"
      version: "2025-01-v2"
      included_at: "2025-01-15T10:35:00Z"
    - id: "comparisons/m365-licenses"
      version: "2025-01-v1"
      included_at: "2025-01-15T10:40:00Z"

  delivery:
    method: "courier"
    share_id: "shr_abc123"
    recipient: "client@example.com"
    delivered_at: "2025-01-20T15:05:00Z"
    expires_at: "2025-01-27T15:05:00Z"

When sharing proposals via Courier:

• Authentication: Recipient must enter PIN to access
• Tracking: All views logged with IP, user agent, timestamp
• Limits: Configurable view count and time expiry
• Revocation: Shares can be revoked immediately
• Audit: Full trail from creation to final access

See also: Courier Security

All security-relevant events are logged:

Report security vulnerabilities to: security@esolia.co.jp

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested remediation (if any)

All security-relevant changes require:

1. InfoSec comment explaining the security consideration
2. Peer review by security-conscious reviewer
3. Automated checks (linting, type-check, tests)

Example:

// InfoSec: Validate tenant isolation - prevents IDOR
const { results } = await db
  .prepare('SELECT * FROM documents WHERE id = ? AND org_id = ?')
  .bind(id, locals.orgId)
  .all();

# Required before any commit
npm run format
npm run lint
npm run check
npm run test
npm audit

• No secrets in code or version control
• Use Cloudflare Workers Secrets
• Rotate credentials regularly
• Minimal secret scope

• OWASP Top 10 - Web application security
• ISO 27001 - Information security management (alignment)
• GDPR - Data protection (EU clients)
• Act on Protection of Personal Information - Japan privacy law

Last updated: 2025-12-29 Security contact: security@esolia.co.jp