{
  "standard": "SECURITY",
  "title": "Novak LMS\u2122 Technical Security, Browser Sandbox Isolation & Cryptographic Audit Matrix",
  "platform": "Novak LMS\u2122",
  "url": "https://novak-lms.onrender.com/compliance",
  "generated_at": "2026-10-27T14:08:04Z",
  "contact": "novakornothing@gmail.com",
  "audit_verification": {
    "verified": true,
    "events_count": 6
  },
  "controls_count": 5,
  "controls": [
    {
      "criteria": "SEC-TLS-01",
      "category": "Transport & Session Encryption",
      "control_name": "TLS 1.3 / HTTPS & Hardened Session Cookies",
      "implementation": "Enforced HTTPS with HSTS (max-age=31536000; includeSubDomains), TLS 1.3 edge termination, and HttpOnly, SameSite=Lax, Secure session cookies.",
      "status": "Active & Verified"
    },
    {
      "criteria": "SEC-AUTH-02",
      "category": "Authentication & Access Control",
      "control_name": "PBKDF2/scrypt Password Hashing, RBAC & LTI 1.3 / SSO",
      "implementation": "Werkzeug salted scrypt/PBKDF2 password hashing, strict role-based access control (@role_required for Student, Instructor, Admin), SAML 2.0 / OIDC SSO, and RSA-2048 JWKS signed LTI 1.3 Advantage handshakes.",
      "status": "Active & Verified"
    },
    {
      "criteria": "SEC-CSRF-03",
      "category": "Request & Input Integrity",
      "control_name": "CSRF Protection, Parameterized Queries & CSP Headers",
      "implementation": "Synchronizer CSRF tokens enforced on all state-changing POST/PUT/DELETE requests, SQLAlchemy parameterized queries, 100% self-hosted vendor assets (zero external CDN scripts), and strict X-Content-Type-Options: nosniff.",
      "status": "Active & Verified"
    },
    {
      "criteria": "SEC-AUDIT-04",
      "category": "Tamper-Evident Audit Logging",
      "control_name": "SHA-256 Cryptographic Hash-Chained Audit Trail",
      "implementation": "Append-only SHA-256 hash-chained AuditEvent log (prev_hash -> entry_hash) for logins, gradebook changes, and data exports, verified continuously at /admin/audit and /security.",
      "status": "Active & Verified"
    },
    {
      "criteria": "SEC-OSS-05",
      "category": "Open-Source Toolchain Governance",
      "control_name": "100% Permissive MIT / Apache-2.0 / BSD-2-Clause Runtime",
      "implementation": "All client and server dependencies (v86 BSD-2-Clause, MediaPipe Apache-2.0, Bootstrap/Flask/SQLAlchemy MIT/BSD) are verified permissive with zero viral copyleft in the host runtime (/compliance/oss-licenses).",
      "status": "Active & Verified"
    }
  ]
}