# Security baseline
HTTPS, WAF/rate limiting at edge, Sanctum/API auth, RBAC, least privilege, session/token revocation, signed URLs for private files, upload scanning, encrypted backups, secret rotation, audit hash chain, staging/production separation.

The secure connector must initiate outbound TLS from accounting/HR PCs; never expose RDP/SMB/database ports to the Internet.