This document outlines the core security practices, threat intelligence integration, and authentication specifications enforced across IronClad services.

• SHA-256 Hashing: API keys generated via APIKeyManager are hashed using SHA-256 prior to in-memory persistence to prevent exposure of raw credentials in dumps or memory inspection.
• Granular Scopes: Credentials support scope-based authorization (e.g., read, write, admin, or wildcard *).

• Claims & Issuer/Audience Validation: JWTManager validates registered claims including Expiration (exp), Issued At (iat), Issuer (iss), and Audience (aud).
• Token Revocation (Blacklist): Distributed token revocation via Redis with automatic in-memory fallback cache when Redis is unavailable.

• HMAC Signatures: Every LogRecord generated by AuditLogger is signed using HMAC-SHA256 (ComputeSignature) over key fields (actor, tenant, action, resource, IP, user-agent).
• Integrity Checks: Signatures can be independently verified using VerifySignature to detect log manipulation.

• Feed Aggregation: Periodically polls threat feeds (abuse.ch, Ipsum) using exponential backoff retry.
• CIDR Whitelisting: Supports registering trusted internal subnets (AddTrustedCIDR) that take precedence over blacklists.

• Strict TLS 1.3: TLS configuration enforces MinVersion: tls.VersionTLS13 for encrypted service-to-service communication.
• Client Auth Options: Supports mandatory client certificate verification (RequireAndVerifyClientCert).

• Hardening Headers: Middleware automatically injects X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Strict-Transport-Security, and Content-Security-Policy.
• Bearer Token Middleware: Intercepts requests, validates JWTs, and verifies revocation status before passing requests to upstream handlers.

Execute the security test and audit suite using the repository Makefile:

make security-audit