SENA.HK

Security

This page summarizes pilot security controls and the evidence still required before production claims.

Current Security Posture

SENA includes session authentication, CSRF protection for cookie-auth mutations, security response headers, audit logs, and protected enterprise API routes. Production readiness still depends on managed identity, storage, backup, observability, and institution-owned operations evidence.

Sensitive Data

Use pseudonymous identifiers for pilot uploads. Keep roster mappings, secrets, credentials, and institutional account details outside exports and source control.

Legacy Runtime Routes

The standalone jENA API route is retained for compatibility but requires an authenticated session and CSRF token before it will run server-side analysis.

Reporting Issues

Report security concerns to the project owner with the affected route, timestamp, and reproduction steps. Do not include passwords, API keys, or real student data in issue reports.