M9-05 Security Hardening — Web Application Firewall (WAF)

Milestone: M9 — Hardening and Compliance SOW Reference: NFR3, Appendix 2 milestone description Requirement Clarity: ✅ Clear Dev Status: ❌ Not started

Overview

Put a WAF in front of the platform to filter common web application attacks (SQLi, XSS, etc.) before they reach the application.

Backend Tasks

• Confirm WAF choice once AWS hosting target (M4-01) is decided (e.g. AWS WAF)
• Define baseline rule sets and test against the existing API surface for false positives

Frontend Tasks

• N/A

Dependencies

• M4-01 AWS hosting decision
• M9-04 DDoS protection — often provisioned together.

Acceptance Criteria

Feeds into "Security testing completed and remediation of Critical and High vulnerabilities completed" (Appendix 3, Overall Solution Acceptance).

Existing Reference Material

None specific.

Blockers & Risks

Same AWS-decision dependency as M9-04.