> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Remediation Release

> Upgrade impact and operator actions for the enterprise security remediation release

This release introduces server-derived authorization, scoped tenant and TLP
queries, one-time local activation, delegated API-key permissions, hardened
egress, bounded ingestion and queue messages, temporary login lockouts, and
production deployment preflight.

## Existing installation impact

Existing databases with users are migrated to `ACTIVE`. Existing passwords,
users, roles, organizations, cases, API keys, and attachments are preserved. No
new administrator is seeded and the setup wizard is not shown.

## Operator actions

1. Back up PostgreSQL, attachments, `.env`, encryption material, and license
   state.
2. Test the upgrade with a sanitized copy of the client database.
3. Add strong Redis, OpenSearch, and MinIO credentials if upgrading an older
   deployment.
4. Add a persistent `AUDIT_INTEGRITY_SECRET` for older installations:

   ```bash theme={null}
   printf 'AUDIT_INTEGRITY_SECRET=%s\n' "$(openssl rand -hex 32)" >> .env
   ```

   Store the value with the backup set; do not rotate it during routine
   upgrades.

   Audit entries created before this release remain marked as legacy,
   unchained records. Integrity verification reports their count separately;
   every entry created after the upgrade must belong to the HMAC chain.
5. Replace mutable image tags with the release's pinned tags or digests.
6. Publish only Nginx ports and install trusted TLS files.
7. Run preflight and the post-deployment canary.
8. Review integration URLs. Private HTTPS destinations require an exact-host
   `CASEBENDER_PRIVATE_EGRESS_ALLOWLIST` entry.

## Compatibility controls

`CASEBENDER_LEGACY_BOOTSTRAP` remains disabled by default. It requires
`ACCEPT_LEGACY_BOOTSTRAP_RISK=true`, an approved owner and expiry, and must not
be enabled for a new production installation.

## Release evidence

* `scripts/security/codex-findings-map.json` maps all 510 baseline fingerprints.
* `pnpm security:policy` enforces repository invariants.
* `pnpm security:test` runs tenant, TLP, SSRF, regex, and queue abuse cases.
* `scripts/security/security-remediation-release.json` defines staged promotion
  and rollback criteria.

A fresh independent scan is required before general availability; implementation
status alone is not evidence that a finding disappeared from scanner output.