# Novak LMS™ Technical Security, Browser Sandbox Isolation & Cryptographic Audit Matrix
- **Platform**: Novak LMS™ (`https://novak-lms.onrender.com` / `https://novakornothing.com`)
- **Generated**: 2026-10-27T14:10:11Z
- **Contact**: `novakornothing@gmail.com`

| CRITERIA | CATEGORY | CONTROL_NAME | STATUS | IMPLEMENTATION |
| --- | --- | --- | --- | --- |
| SEC-TLS-01 | Transport & Session Encryption | TLS 1.3 / HTTPS & Hardened Session Cookies | Active & Verified | Enforced HTTPS with HSTS (max-age=31536000; includeSubDomains), TLS 1.3 edge termination, and HttpOnly, SameSite=Lax, Secure session cookies. |
| SEC-AUTH-02 | Authentication & Access Control | PBKDF2/scrypt Password Hashing, RBAC & LTI 1.3 / SSO | Active & Verified | Werkzeug salted scrypt/PBKDF2 password hashing, strict role-based access control (@role_required for Student, Instructor, Admin), SAML 2.0 / OIDC SSO, and RSA-2048 JWKS signed LTI 1.3 Advantage handshakes. |
| SEC-CSRF-03 | Request & Input Integrity | CSRF Protection, Parameterized Queries & CSP Headers | Active & Verified | Synchronizer CSRF tokens enforced on all state-changing POST/PUT/DELETE requests, SQLAlchemy parameterized queries, 100% self-hosted vendor assets (zero external CDN scripts), and strict X-Content-Type-Options: nosniff. |
| SEC-AUDIT-04 | Tamper-Evident Audit Logging | SHA-256 Cryptographic Hash-Chained Audit Trail | Active & Verified | Append-only SHA-256 hash-chained AuditEvent log (prev_hash -> entry_hash) for logins, gradebook changes, and data exports, verified continuously at /admin/audit and /security. |
| SEC-OSS-05 | Open-Source Toolchain Governance | 100% Permissive MIT / Apache-2.0 / BSD-2-Clause Runtime | Active & Verified | All client and server dependencies (v86 BSD-2-Clause, MediaPipe Apache-2.0, Bootstrap/Flask/SQLAlchemy MIT/BSD) are verified permissive with zero viral copyleft in the host runtime (/compliance/oss-licenses). |