# Compatibility & Security Plan

## Assessment Date
- 2026-03-09

## Scope
- Project: `NGauge_Base`
- Focus: runtime compatibility, dependency hygiene, credential handling, and application security posture.

## Checks Run
- `php -v` → PHP `8.5.3` active.
- `composer check-platform-reqs` → pass.
- `composer validate --no-check-publish` → lock drift + dependency constraint warnings.
- `composer audit --no-interaction` → no advisories reported.
- Targeted static scans for credential/secrets patterns and risky config patterns.

## Findings

### Compatibility
1. PHP requirement uplift is active and satisfied.
   - `composer.json` requires `>=8.5.0`.
   - Runtime is now `8.5.3` and passes platform checks.
2. Composer lock drift remains.
   - `composer validate` reports lock file not up to date with `composer.json`.
3. High use of unbounded dependency constraints (`"*"`) and dev-channel constraints increases update volatility.

### Security
1. Hardcoded credentials/secrets exist in tracked source files.
   - Examples include API keys, OAuth client secrets, and token secrets.
2. Composer audit policy is permissive.
   - `config.audit.block-insecure` is `false`.
   - explicit advisory ignore list is configured.
3. Sensitive token disclosure to output exists.
   - Token values are echoed in Sage integration flows.
4. CSRF is globally disabled in multiple controller contexts.
5. Access tokens are passed via URL query strings in Ecwid API requests (higher leak risk via logs/proxies).
6. Debug bootstrap includes `debug` unconditionally in backend bootstrap array.

## Prioritized Improvement Plan

### P0 (Immediate: same day)
1. Revoke and rotate all exposed secrets.
2. Move secrets to environment or local non-repo config (`params-local.php`, env vars, vault).
3. Remove all token/key echo output from runtime paths and clear historical logs where applicable.
4. Tighten Composer audit policy:
   - set `config.audit.block-insecure` to `true`;
   - remove blanket ignore entries unless documented with expiry and owner.

### P1 (Near-term: 1-3 days)
1. Rebuild and commit lock file under PHP 8.5 baseline.
   - run `composer update --lock` and validate in CI.
2. Replace `"*"` constraints with bounded semver ranges package-by-package.
3. Limit CSRF exceptions to explicit webhook endpoints and add signature verification.
4. Replace query-token API usage with Authorization headers where provider supports it.
5. Gate debug/gii bootstrapping strictly by environment and trusted IP policy.

### P2 (Short-term hardening: 1-2 weeks)
1. Add secret scanning to CI (pre-commit + pipeline).
2. Add automated dependency policy checks (audit on PR/build with fail gates).
3. Add scheduled dependency refresh cadence and compatibility matrix checks.
4. Add security test checklist for integrations (SendGrid, Sage, NetSuite, Graph, Ecwid).

## Success Criteria
- No hardcoded production secrets in repository.
- Composer audit blocks insecure packages in CI.
- Lock file and manifest remain synchronized.
- Dependency constraints are bounded and reproducible.
- Token/secret values are never printed to output or logs.
- CSRF posture is explicit and documented for exceptions only.
