Security for public bodies
This section is for information security officers, administrators, developers, hosting teams and project managers of
public bodies that run a site with Exponential. Every product statement comes from the repository: the project's
Security standards (whose status words "Partly complies", "Unverified" and, for
OWASP A09, "Complies" are kept as written), Security hardening,
Chapter 13 of the installation guide, the audit guide and the feature pages.
Gaps are named where they exist: lockout off by default, two-step sign-in opt-in, CSP report-only on the administration
and off on sites, HSTS empty by default, no security.txt shipped, no dependency scan in the project's CI.
Contents
Reading order
- Security officers and project managers: posture at a glance, the OWASP mappings, the framing pages (NIS2, NIST CSF, ISO 27001), go-live checklist, penetration tests, incident response.
- Administrators: hardening overview, then the pages on sign-in, sessions, headers, HTTPS, CSP, the audit trail, logs and backups.
- Developers and hosting teams: CSP plan, uploads, form tokens, proxies, file permissions, configuration managed by the deployment, request-shield.
Pages in this section
| Page | Answers |
|---|---|
| Exponential's security posture at a glance | status by standard; on and off by default; known gaps |
| Mapping the OWASP Top 10 to Exponential | mitigations, your part and evidence per category |
| Mapping OWASP ASVS to Exponential | controls by chapter; the password length gap |
| Hardening an Exponential site for a public body | the layers in order |
| Go-live security checklist for public sites | checklist with evidence to file |
| The audit trail for public bodies | what is recorded (and not), retention, who reads |
| Audit alerts and their recipients | the seven shipped rules; routing mail |
| Audit integrity and verification | hash chains, checkpoints, verify, broken chains |
| Forwarding the audit trail to a SIEM | syslog and webhook sinks |
| Two-step sign-in for public staff | turning on, requiring, rolling out, lost phones |
| Content Security Policy for public sites | how it ships, settings, reports |
| From report-only to an enforced CSP | a staged plan with rollback |
| request-shield in front of a public site | a separate firewall; monitor first |
| Request logs and the security log | 404.log, security.log, masking, retention |
| Security headers | the five defaults; checking and changing |
| HTTPS and HSTS | steps, settings, raising HSTS safely |
| Password policy | settings and a length-based policy |
| Account lockout | off by default; enabling, unlocking |
| Sessions and cookies | cookie flags, timeouts, signing users out |
| Roles and least privilege | sensitive policies, a role design, access reviews |
| File uploads and SVG | upload defenses and the SVG sanitizer |
| Configuration managed by the deployment | locking configuration changes in production |
| File consistency check | detecting changed files |
| Vulnerability disclosure | the project's policy and your own |
| Adding security.txt | RFC 9116 file and the rewrite rule |
| Patching cadence | what to watch and an update routine |
| NIS2 and an Exponential site | general framing of common measures |
| NIST Cybersecurity Framework and an Exponential site | the six functions |
| ISO/IEC 27001 and an Exponential site | ISMS scope and evidence |
| Penetration tests of an Exponential site | scope, preparation, findings |
| Secrets in settings/override | which files hold secrets and how to protect them |
| Separating the administration | own host, network restriction, request rules |
| Log review routine | weekly and monthly checks |
| Debug output in production | safe defaults; debugging for one address |
| CSRF and form tokens | ezformtoken and custom code |
| Proxies and trusted headers | TrustedProxies[], reading from the right |
| File permissions and ownership | one writer, read-only code, hardened modes |
| Backups and recovery | consistent backups, restore tests, smaller recoveries |
| Incident response for an Exponential site | contain, investigate, rebuild, notify |
Tasks that apply these pages step by step are in the compliance tasks of this help (Compliance tasks).
Related pages
- Up: Governments: start here
- Security standards
- Security hardening
- Security for hosts
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.