A01 Broken access control: A defined role and permission catalogue, application-enforced tenant scoping (mandatory tenant ID on every record + tenant-scoped queries), object-based authorization per entity, stateless sessions.

A02 Cryptographic failures: TLS 1.2+/1.3, AES-256 at every storage layer; customer documents are additionally encrypted under a dedicated per-tenant key, no local password storage.

A03 Injection: Only type-safe queries (no raw SQL), WAF injection patterns, Vue auto-escaping, secure deserialization.

A04 Insecure design: Layered architecture, CSRF protection, rate limiting.

A05 Security misconfiguration: IaC scanning, isolated management ports, no default credentials, schema validation.

A06 Vulnerable components: Automatic dependency checks (CVSS ≥ 7 blocks build), continuous monitoring.

A07 Authentication failures: OAuth2/OIDC, MFA, JWT validation with issuer whitelist.

A08 Data integrity failures: CI/CD gates, secret scanning, secure deserialization.

A09 Logging failures: Audit trail, CloudTrail, real-time error tracking.

A10 SSRF: IMDSv2 enforced, no custom URLs, WAF, VPC isolation.