Security by Design.
A technical overview of defensive engineering in the Alegor Platform: default-deny authorization, tenant boundaries, immutable auditing, and cryptographic validation.
Identity & Credential Safety
Argon2id/Bcrypt password hashing with automatic rehash triggers. Native support for TOTP MFA, WebAuthn hardware tokens, and enterprise SAML 2.0 / OIDC federation.
Default-Deny RBAC & ABAC
Every resource and route requires explicit capability grants. Dynamic policies evaluate contextual attributes (IP, time, monetary thresholds) with zero implicit allowances.
Strict Tenant Boundaries
Global ORM query scopes automatically enforce tenant constraints at the repository level. Support for both pooled multi-tenant schemas and dedicated single-tenant VPC databases.
Append-Only Audit Logs
All state mutations generate immutable audit records with actor context, IP, and before/after diffs. Database user roles hold no UPDATE or DELETE grants on audit tables.
HMAC Signatures & Nonces
Inbound and outbound webhooks enforce SHA256 HMAC cryptographic signatures and timestamp nonces to mitigate replay attacks and payload spoofing.
Dependency Management
Automated CI security audits (`composer audit`), locked lockfiles, minimal surface area third-party libraries, and continuous vulnerability monitoring.
Technical Guides
Security & Permission Articles
Why Audit Logs Matter in Business-Critical Software
Designing immutable, tamper-evident audit logs: data schemas, asynchronous ingestion, forensic accountability, and compliance architecture.
RBAC vs ABAC: Which Authorization Model Should You Use?
A technical comparison of Role-Based Access Control and Attribute-Based Access Control, detailing when static roles fail and how hybrid architectures succeed.
RBAC Explained: Designing Permissions for Complex Business Systems
A definitive guide to implementing scalable Role-Based Access Control (RBAC): hierarchy trees, scoping, caching strategies, and common anti-patterns.