Defaults with boundaries.

Browser defenses

Responses include a restrictive same-origin CSP, nosniff, DENY framing, Referrer-Policy, Permissions-Policy and a generated request ID. HTTPS production responses also include HSTS for this host. Views provide an escaping helper. Keep script and style assets external; do not add unsafe-inline to solve CSP errors.

CSRF for the browser demo

GET /api/csrf issues a signed expiring token and HttpOnly, SameSite=Strict cookie. HTTPS uses a Secure __Host- cookie. Send the token as X-CSRF-Token with unsafe methods. The middleware checks the signature, expiry, cookie equality and supplied Origin. No cross-origin CORS access is enabled. This is CSRF protection, not authentication; do not treat the demo token as a user credential.

Passwords and encryption

use Icom\Security\Crypto;

$hash = Crypto::hashPassword($password); // Argon2id
$valid = Crypto::verifyPassword($password, $hash);

$crypto = new Crypto($raw32ByteKey);
$ciphertext = $crypto->encrypt('private value');
$plaintext = $crypto->decrypt($ciphertext);
// Libsodium secretbox: random nonce + authenticated encryption.

Escaped views

<!-- resources/views/example.php -->
<h1><?= $e($data['title']) ?></h1>

// Controllers select a trusted template name.
return Response::html($view->render('example', ['title' => $title]));

Enterprise work still required

This preview has no authentication UI, RBAC engine, OIDC/SAML provider, multi-tenant policy layer, secret manager integration, independent penetration test or compliance certification. Add authorization and a maintained identity provider for your application. A custom framework has a much smaller maintenance and review history than Laravel/Symfony. Review SECURITY.md and run tests and dependency audits before adoption.