Security Governance
Security Gate
Enterprise security, RBAC, evidence integrity and compliance controls for the YONGYEOKYO Global Trade Operating System.
Security Headers
| Header | Value | Purpose | Status |
|---|---|---|---|
| Content-Security-Policy | default-src self; frame-ancestors none; object-src none | Prevents script/object/frame injection surfaces | |
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload | Requires HTTPS transport in production | |
| X-Frame-Options | DENY | Blocks clickjacking fallback for legacy clients | |
| X-Content-Type-Options | nosniff | Prevents MIME sniffing | |
| Referrer-Policy | strict-origin-when-cross-origin | Limits cross-origin referrer leakage | |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Blocks unused browser capabilities | |
| Cross-Origin-Opener-Policy | same-origin | Hardens browsing context isolation | |
| Cross-Origin-Resource-Policy | same-origin | Restricts cross-origin resource reuse |
RBAC / ABAC Roles
| Role | Permissions | Scope | Status |
|---|---|---|---|
| Administrator | read/write/approve/audit/legal/vault/rfq/config/analytics/docs | Full governance role | |
| Compliance Officer | read/approve/audit/legal/vault | Trust, Vault and controlled approval role | |
| Auditor | read/audit/legal/vault | Evidence and audit review role | |
| Operator | read/write/rfq | Operations and controlled RFQ role | |
| Buyer | read/rfq/docs | Buyer workspace and documentation request role | |
| Supplier | read/rfq/docs | Supplier evidence and RFQ response role | |
| Investor | read/analytics | Read-only intelligence role |
Security acceptance matrix
| Layer | Control | Placement | Purpose | Status |
|---|---|---|---|---|
| Header | Content-Security-Policy | default-src self; frame-ancestors none; object-src none | Prevents script/object/frame injection surfaces | |
| Header | Strict-Transport-Security | max-age=31536000; includeSubDomains; preload | Requires HTTPS transport in production | |
| Header | X-Frame-Options | DENY | Blocks clickjacking fallback for legacy clients | |
| Header | X-Content-Type-Options | nosniff | Prevents MIME sniffing | |
| Header | Referrer-Policy | strict-origin-when-cross-origin | Limits cross-origin referrer leakage | |
| Header | Permissions-Policy | camera=(), microphone=(), geolocation=() | Blocks unused browser capabilities | |
| Header | Cross-Origin-Opener-Policy | same-origin | Hardens browsing context isolation | |
| Header | Cross-Origin-Resource-Policy | same-origin | Restricts cross-origin resource reuse | |
| API | RFQ API | POST /api/rfq | Requires x-yong-role with rfq permission | |
| API | Audit API | POST /api/audit | Requires x-yong-role with audit permission | |
| API | Search API | GET /api/search | Validated query contract and role-aware search envelope | |
| API | Trust API | GET /api/trust | Read-only compliance and verification surface | |
| API | Health API | GET /api/health | Safe deterministic status payload for platform probes | |
| API | Readiness API | GET /api/readiness | Runtime readiness payload for deployment checks | |
| Compliance | No public offer | Legal disclosure footer and RFQ-gate copy | Commercial risk control | |
| Compliance | Export-control review | Legal center + material legal disclosure | Strategic material screening | |
| Compliance | Evidence hashing | lib/server/audit.ts SHA-256 evidence hash | Audit integrity baseline | |
| Compliance | Vendor-neutral SDS/MSDS | Vault evidence package | Supplier/recredentialing risk control | |
| Compliance | Production boundary | External Docker/CI/E2E/deployment evidence remains required | Readiness honesty control |
Production security boundary
Application-side security gates are enforced in this repository. Full Production Ready still requires security verification from the live deployment URL and external Docker/CI/E2E evidence.
- External Docker build evidence
- CI runner logs
- Browser E2E on unrestricted runner
- Live deployment smoke test
- Security headers verified from production URL
- TLS certificate and HSTS verified on production domain