# Security and private-file plan

Use Laravel authentication with verified email, password reset, remember-me, regenerated sessions after login, throttled login, CSRF protection, secure/HTTP-only cookies, escaped output, and Form Requests. Public sign-up is disabled. Invitation tokens are random, only their hashes are stored, and acceptance atomically consumes the token after verifying expiry/revocation/email.

## Private files

Set the default disk to `private`, rooted outside `public_html` where cPanel allows (for example `/home/CPANEL_USER/clickmagnets-storage`). Store a UUID path, never the original filename. The database stores original name, extension, MIME, byte size, hash, owner, category, and associations. Validate extension + server-detected MIME + size; reject PHP, scripts, executables, and unapproved SVG. Downloads use a controller, `FilePolicy`, `Content-Disposition: attachment`, and a download activity event. Do not create a public storage symlink for client work.

Verify with tests that client A cannot access client B, designers cannot access unrelated projects/invoices, guests cannot fetch a stored filename, internal comments/annotations do not render in the portal, and revoked/expired invitations fail.