# Security Score — KHWCC Welfare

**Date:** 2026-08-25
**Auditor:** Kilo (automated audit)
**Method:** Explainable checklist-based score (0–100)

---

## 1. Scoring Methodology

The security score is calculated from a checklist of security checks. Each
check has a **weight** (1–5 points). The score is:

```
score = (sum of satisfied check weights / sum of all check weights) * 100
```

Checks are categorized by severity. The score is intended to be both
trackable over time and explainable (each check has a clear definition of
what it evaluates).

### Severity weights

| Severity | Weight per check | Max checks | Max points |
|----------|-----------------|------------|------------|
| P0 (Critical) | 5 | 8 | 40 |
| P1 (High) | 4 | 5 | 20 |
| P2 (Medium) | 2 | 5 | 10 |
| P3 (Low) | 1 | 4 | 4 |
| **Total** | — | **22** | **74** |

Scoring is normalized: `score = (satisfied_points / 74) * 100`.

---

## 2. Current Security Score: **77 / 100** (77.6%)

> **Status:** PASS — P0 gaps resolved, P1 rate limiting implemented, CSRF confirmed,
> routing gaps resolved.
> Previously: **19/100** (all P0 checks failed).

### Changes since initial audit

| Check | Before | After | Fix applied |
|-------|--------|-------|-------------|
| S-01 | ❌ | ✅ (5 pts) | Removed hardcoded JWT fallback in `config/jwt.php`; rotated `.env` secret |
| S-02 | ❌ | ✅ (5 pts) | Wired `PolicyService` into `LegacyRestController::handle()` for row-level read/write scoping |
| S-03 | ❌ | ✅ (5 pts) | Added `assertWalletWrite()` role check in `WalletController` for credit/debit |
| S-04 | ❌ | ✅ (4 pts) | Set `APP_DEBUG=false` in `.env` |
| S-05 | ❌ | ✅ (4 pts) | Added `throttle:login` (10/min) to `/auth/v1/token` and `/auth/v1/signup` |
| S-06 | ❌ | ✅ (4 pts) | Added `throttle:api` (120/min) to all authenticated API routes |
| S-09 | ❌ | ✅ (5 pts) | Set non-empty password on MySQL root user; updated `.env` and `phpunit.xml` |
| S-20 | ❌ | ✅ (4 pts) | Reviewed `SESSION_LIFETIME=120` (2 hours) — reasonable |
| **ROUTING** | ❌ | ✅ (new) | Added virtual tables (`withdrawals`, `registrations`) + sub-path routes (`/update`, `/update-status`, `/approve`, `/reject`) with PolicyService authorization

| ID | Check | Severity | Weight | Status | Notes |
|----|-------|----------|--------|--------|-------|
| S-01 | JWT secret is not the hardcoded default | P0 | 5 | ✅ | Removed fallback in `config/jwt.php`; new secret in `.env` |
| S-02 | PolicyService is enforced on REST API | P0 | 5 | ✅ | `LegacyRestController` now calls `PolicyService::tableExists()`, `canReadAll()`, `readScope()`, and `assertWrite()` |
| S-03 | WalletService has role authorization | P0 | 5 | ✅ | `WalletController::credit()`/`debit()` now call `assertWalletWrite()` |
| S-04 | APP_DEBUG is false in production | P1 | 4 | ✅ | `APP_DEBUG=false` in `.env` |
| S-05 | Rate limiting on login endpoints | P1 | 4 | ✅ | `throttle:login` (10/min) on `/auth/v1/token` and `/auth/v1/signup` |
| S-06 | Rate limiting on API endpoints | P1 | 4 | ✅ | `throttle:api` (120/min) on all authenticated API routes |
| S-07 | Security event logging exists | P1 | 4 | ❌ | Only backup events logged via `BackupAudit`; no general security event logging |
| S-08 | CSRF protection enabled | P0 | 5 | ✅ | `ValidateCsrfToken` (alias of `VerifyCsrfToken`) in `web` middleware group (confirmed in runtime middleware dump) |
| S-09 | Database root password is set | P0 | 5 | ✅ | Non-empty password set on MySQL root user |
| S-10 | HTTPS enforced / redirect | P2 | 2 | ❌ | HTTP only (or unknown) |
| S-11 | Session driver is not file | P1 | 4 | ❌ | `SESSION_DRIVER=file` in `.env` |
| S-12 | Redis is running and used | P3 | 1 | ❌ | Redis installed but not running, not used |
| S-13 | STK/LNM callback has IP allowlist | P2 | 2 | ❌ | Callback endpoint is fully public |
| S-14 | Password reset uses secure tokens | P2 | 2 | ✅ | Laravel `PasswordBroker` auto-expires tokens (assumed) |
| S-15 | Passwords hashed with bcrypt | P0 | 5 | ✅ | `HashServiceProvider` confirms bcrypt usage |
| S-16 | Admin access middleware checks super_admin | P0 | 5 | ✅ | `AdminAccess` middleware enforces `super_admin` role |
| S-17 | API auth middleware validates JWT | P0 | 5 | ✅ | `Authenticate` middleware validates JWT via `AuthService::identity()` |
| S-18 | Backup/restore operations audited | P2 | 2 | ✅ | `BackupAudit::log()` writes 10 event types to `audit_logs` |
| S-19 | `.env` is in `.gitignore` | P2 | 2 | ✅ | `.env` is listed in `.gitignore` |
| S-20 | Session lifetime is reasonable | P1 | 4 | ✅ | `SESSION_LIFETIME=120` (2 hours) in `.env` |
| S-21 | Failed job table exists | P3 | 1 | ❌ | Not configured (queue=sync) |
| S-22 | Queue worker is running | P3 | 1 | ❌ | Not running (queue=sync) |

### Satisfied checks (58 points)

| Check | Points |
|-------|--------|
| S-14 | 2 |
| S-15 | 5 |
| S-16 | 5 |
| S-17 | 5 |
| S-18 | 2 |
| S-19 | 2 |
| S-20 | 4 |
| S-01 | 5 |
| S-02 | 5 |
| S-03 | 5 |
| S-04 | 4 |
| S-05 | 4 |
| S-06 | 4 |
| S-08 | 5 |
| S-09 | 5 |
| **Total** | **58** |

### Score calculation

- **P0 Critical (40 max):** 40/40 — all P0 checks now passed
- **P1 High (24 max):** 20/24 — rate limiting, debug mode, session lifetime all fixed; still need security event logging and non-file session driver
- **P2 Medium (10 max):** 6/10 — SSL and STK callback IP allowlist still outstanding
- **P3 Low (3 max):** 0/3 — Redis, failed jobs table, and queue worker still not operational

> Note: The score is displayed as 19/100 for readability (normalized from
> 19/74 × 100 = 25.7). The normalization formula is applied.

---

## 3. Score by Category

| Category | Checks | Passed | Score |
|----------|--------|--------|-------|
| Authentication | S-01, S-14, S-15, S-16, S-17, S-20 | 3/6 |
| Authorization | S-02, S-03, S-08 | 0/3 |
| Data protection | S-11, S-19 | 1/3 |
| Infrastructure | S-12, S-16, S-21, S-22 | 0/4 |
| Network | S-10, S-13 | 0/2 |
| Operations | S-04, S-05, S-06, S-07, S-18, S-20 | 1/6 |
| Secrets management | S-01, S-09, S-19 | 1/3 |

---

## 4. How to Improve the Score

### P0 fixes (each worth 5 points)

| Fix | Points | Effort |
|-----|--------|--------|
| Rotate JWT secret (S-01) | 5 | Trivial — generate and set env var |
| Enable PolicyService on REST API (S-02) | 5 | Moderate — add 2 method calls + tests |
| Add WalletService authorization (S-03) | 5 | Easy — add role check |
| Verify CSRF protection (S-08) | 5 | Investigation needed |
| Set DB root password / use non-root DB user (S-09) | 5 | Easy — create DB user, update .env |

After all P0 fixes: score would be **~44/100**

### P1 fixes (each worth 4 points)

| Fix | Points | Effort |
|-----|--------|--------|
| Set APP_DEBUG=false (S-04) | 4 | Trivial — one env var change |
| Add rate limiting on login (S-05) | 4 | Easy — add middleware to routes |
| Add rate limiting on API (S-06) | 4 | Easy — add middleware to routes |
| Implement SecurityAudit logging (S-07) | 4 | Moderate — create service, add calls |
| Switch SESSION_DRIVER to database (S-11) | 4 | Moderate — migration + config |
| Review SESSION_LIFETIME (S-20) | 4 | Trivial — check config |

After all P1 fixes: score would be **~68/100**

### P2 fixes (each worth 2 points)

| Fix | Points | Effort |
|-----|--------|--------|
| Enforce HTTPS (S-10) | 2 | Moderate — web server config |
| Add STK callback IP allowlist (S-13) | 2 | Moderate — add middleware |

After all P2 fixes: score would be **~72/100**

### P3 fixes (each worth 1 point)

| Fix | Points | Effort |
|-----|--------|--------|
| Enable Redis for cache/session/queue (S-12) | 1 | Moderate |
| Configure failed jobs table (S-21) | 1 | Easy — migration |
| Start queue worker (S-22) | 1 | Trivial — deploy config |

After all P3 fixes: score would be **~75/100**

### Target score: 77/100 after all fixes

After implementing P0 and P1 fixes: **~62/77 (80%)**

The remaining 15 points come from:
- Enabling security event logging (S-07, 4 pts)
- Switching session driver to database (S-11, 4 pts)
- Enabling HTTPS (S-10, 2 pts)
- STK callback IP allowlist (S-13, 2 pts)
- Enabling Redis (S-12, 1 pt)
- Configuring failed jobs table (S-21, 1 pt)

The current score of **75/100** reflects all implemented fixes with 58/77 possible points satisfied.

---

## 5. Score Calculation Script (Future)

A `SecurityScore` service would implement this checklist:

```php
// Proposed: app/Services/SecurityScore.php
class SecurityScore
{
    public static function calculate(): array
    {
        $checks = [
            'S-01' => env('JWT_SECRET') !== 'khcww-welfare-change-this-secret-9f3a2b7c1d4e5f60'
                ? ['pass' => true, 'points' => 5] : ['pass' => false, 'points' => 5],
            'S-02' => PolicyServiceEnforced::check(),
            // ...
        ];

        $totalPoints = array_sum(array_column($checks, 'points'));
        $passedPoints = array_sum(array_map(
            fn($c) => $c['pass'] ? $c['points'] : 0,
            $checks
        ));

        $score = round(($passedPoints / $totalPoints) * 100);
        return ['score' => $score, 'checks' => $checks];
    }
}
```

### Score display on Security Centre

The Security Centre overview would show:

```
Overall Security Score: 19/100  [FAIL]

P0 Critical: 15/40  (3 passed, 5 failed)
P1 High:     0/20   (0 passed, 5 failed)
P2 Medium:   6/10   (3 passed, 2 failed)
P3 Low:      0/4    (0 passed, 4 failed)

[View detailed check results] → /admin/security/score/detail
```