SEQN Auth Hardening Guide

This guide covers pre-launch and recurring security hardening for the SEQN Auth MVP. Invitation email delivery and OTP email are available through hosted Croox when configured; account recovery is exposed as an Authentik handoff through SEQN Auth, while email verification workflows and payment collection remain outside the current MVP.

Edge and transport

  • Serve auth.seqn.in and accounts.seqn.in over HTTPS only.
  • Keep HSTS enabled with includeSubDomains once both domains are stable.
  • Keep X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin.
  • Keep hosted auth and docs pages protected with X-Frame-Options: DENY and CSP frame-ancestors 'none'.
  • Expose Silver Auth API only through Caddy or the approved reverse proxy.
  • Keep direct API ports bound to localhost or internal Docker networks.
  • Keep browser SDK CORS headers explicit; x-seqn-publishable-key must remain allowed on public config routes.

Authentik

  • Require MFA for platform admins.
  • Keep platform admin access gated through SEQN-A.
  • Use least-privilege Authentik API tokens for provisioning.
  • Rotate Authentik API tokens on exposure or regular cadence.
  • Keep Authentik provider/client secrets out of browser-visible config.

Sessions and cookies

  • Keep SESSION_COOKIE_SECURE=true in production.
  • Keep SESSION_COOKIE_SAMESITE=Lax unless a specific cross-site flow requires a reviewed change.
  • Use at least 32 random characters for SESSION_SECRET.
  • Use distinct 32+ character values for application-secret hashes, invitation-token hashes, webhook secret hashes/encryption, and Google OAuth secret hashes/encryption.
  • When introducing new secret-domain env vars to an existing deployment, first count existing app keys, webhooks, invitations, and sealed Google OAuth metadata; preserve old values or intentionally reissue affected secrets before restart.
  • Treat session-secret rotation as a forced sign-out event, but keep non-session secret-domain rotation scoped to the affected integrations.
  • Prefer short operational shells over copying cookies or tokens.

Project and webhook secrets

  • Display sk_live_ and whsec_ values only once.
  • Store only hashes or sealed secrets server-side.
  • Keep hash secrets and encryption secrets separate from SESSION_SECRET.
  • Never return project secret keys, webhook secrets, Authentik API tokens, or OIDC client secrets from public APIs.
  • Rotate secrets after exposure, employee access changes, or environment moves.

Database and backups

  • Keep Postgres ports private to Docker networks.
  • Use strong, unique AUTHENTIK_PG_PASS and SILVER_POSTGRES_PASSWORD values.
  • Run local backups and encrypted offsite backups.
  • Keep env.backup permission-restricted.
  • Verify restore with drills, not only backup creation.

Admin and support

  • Require admin role for org mutations.
  • Require SEQN-A only for platform Authentik proxy operations.
  • Use audit logs for project, user, role, subscription, webhook, and secret-rotation actions.
  • Avoid raw secrets in support tools, screenshots, and alert payloads.
  • Revoke sessions for lost devices, offboarding, or suspicious access.

Webhook safety

  • Require HTTPS endpoint URLs for production receivers.
  • Sign all webhook payloads.
  • Ask receivers to verify timestamp and HMAC.
  • Use idempotency on receivers because retries can happen.
  • Monitor delivery failure trends and retry backlog.

Email safety

  • Keep CROOX_API_KEY only in deployment secrets, never in docs, screenshots, or browser-visible config.
  • Keep EMAIL_ENABLED=false until hosted Croox organization/environment/domain/template IDs, the ck_... key, and the approved sender are ready.
  • Keep EMAIL_DELIVERY_WORKER_ENABLED=false until Croox smoke passes; then tune worker interval and batch size to the provider's limits.
  • Treat the email outbox as sensitive because invitation bodies contain one-time links; public/admin APIs should expose only sanitized delivery metadata.
  • Monitor invitation delivery status and retry backlog before public onboarding.

Rate limits and abuse

  • Keep the app limiter enabled.
  • Tune RATE_LIMIT_ENABLED, RATE_LIMIT_WINDOW_MS, and RATE_LIMIT_MAX per deployment.
  • Use edge/proxy rules for route-specific limits.
  • Alert on sustained 429, not isolated bursts.
  • Rotate exposed secrets when abuse follows a single key prefix.
  • Block hostile sources at the edge before changing global app limits.

Launch checklist

  • Public health, config, client-config, backend-key, and console-boundary checks are monitored.
  • SDK CORS preflight and docs-host persistence checks are monitored.
  • Non-email alerts are routed to an attended channel.
  • Local backup and offsite encrypted backup schedules are active.
  • A restore drill has been completed.
  • Admin MFA is enabled.
  • SEQN-A membership is limited to platform admins.
  • Public package names are Free, Pro, and Scale.
  • Hosted Croox email is configured and direct email plus OTP delivery are smoked.
  • /auth/recovery redirects to the configured Authentik recovery flow; SEQN Auth transactional and OTP email use Croox, while Authentik-native recovery email delivery still depends on its own flow/provider behavior.
  • Email verification and payment flows remain documented as outside the current MVP.