Skip to content

Commit 544e9cb

Browse files
Update SECURITY.md documentation
- Remove reference to non-existent migration script - Fix contradictory "No Database Encryption" limitation (encryption is available) - Update version history to v2.3 - Update last modified date 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>
1 parent 16ed8ad commit 544e9cb

File tree

1 file changed

+11
-15
lines changed

1 file changed

+11
-15
lines changed

SECURITY.md

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -136,12 +136,7 @@ DB_ENCRYPTION_KEY=<your-db-key>
136136
FILE_ENCRYPTION_KEY=<your-file-key>
137137
```
138138

139-
3. For new installations, encryption is automatic once keys are set
140-
141-
4. For existing installations, run migration:
142-
```bash
143-
python migrate_to_encryption.py
144-
```
139+
3. Restart the application - encryption is automatic once keys are set
145140

146141
**CRITICAL SECURITY NOTES:**
147142
- ⚠️ **Backup encryption keys separately from data!**
@@ -349,18 +344,14 @@ WantedBy=multi-user.target
349344
1. **No Two-Factor Authentication (2FA)**
350345
- Planned: TOTP-based 2FA
351346

352-
2. **No Database Encryption**
353-
- Current: SQLite without encryption
354-
- Planned: SQLCipher integration
355-
356-
3. **No Audit Logging**
347+
2. **No Audit Logging**
357348
- Planned: Comprehensive audit trail
358349

359-
4. **Basic Password Policy**
350+
3. **Basic Password Policy**
360351
- Current: 6 character minimum
361352
- Planned: Complexity requirements, strength meter
362353

363-
5. **No Email Verification**
354+
4. **No Email Verification**
364355
- Planned: Email verification on registration
365356

366357
## Reporting Security Issues
@@ -379,7 +370,12 @@ We will respond within 48 hours and work with you to address the issue.
379370

380371
## Version History
381372

382-
### v2.2 (Current)
373+
### v2.3 (Current)
374+
- Added optional database encryption (SQLCipher)
375+
- Added optional file encryption (Fernet)
376+
- OIDC/SSO authentication support
377+
378+
### v2.2
383379
- Added CSRF protection (Flask-WTF)
384380
- Implemented rate limiting (Flask-Limiter)
385381
- Enforced SECRET_KEY requirement
@@ -400,5 +396,5 @@ We will respond within 48 hours and work with you to address the issue.
400396

401397
---
402398

403-
**Last Updated:** 2025-11-20
399+
**Last Updated:** 2025-12-10
404400
**Maintained By:** HSA Tracker Development Team

0 commit comments

Comments
 (0)