Security
This page summarizes pilot security controls and the evidence still required before production claims.
Current Security Posture
SENA includes session authentication, CSRF protection for cookie-auth mutations, security response headers, audit logs, and protected enterprise API routes. Production readiness still depends on managed identity, storage, backup, observability, and institution-owned operations evidence.
Sensitive Data
Use pseudonymous identifiers for pilot uploads. Keep roster mappings, secrets, credentials, and institutional account details outside exports and source control.
Legacy Runtime Routes
The standalone jENA API route is retained for compatibility but requires an authenticated session and CSRF token before it will run server-side analysis.
Reporting Issues
Report security concerns to the project owner with the affected route, timestamp, and reproduction steps. Do not include passwords, API keys, or real student data in issue reports.