Security posture for commercial FirstReq access

Public paid registration creates access only after verified email and Stripe webhook activation; free pilot access requires owner approval.

• Sign-in uses neutral magic-link flows without passwords.
• Organization admin and platform owner routes are separated.
• Sensitive operations require explicit permissions and step-up state.

Workspace data must remain scoped by organization across API routes, read models, jobs, exports, and audit queries.

• Cross-tenant access paths are release blockers when untested.
• Platform owner visibility is internal and audited.
• Support impersonation is not part of the FirstReq product.

Security-sensitive events are captured so owner/admin review can reconstruct what changed and why.

• Auth, MFA, billing, export, contact reveal, and owner actions require audit events.
• Pilot access requests are captured as owner-visible operational audit records.
• High-risk actions must preserve actor, target, reason, and timestamp context.

External credentials and webhooks are production gates, not static frontend configuration.

• Email, Stripe, and provider credentials must live in secrets, not git.
• Webhook payloads must be signed, versioned, retryable, and idempotent.
• Live production readiness requires external service diagnostics to pass.