HR Insight handles sensitive business data (employee salaries, financial records, corporate strategy). This document covers all security layers, from authentication to data validation, CSP headers, SRI hashes, and App Check.

• Users authenticate via Google OAuth 2.0 through Firebase Authentication
• No passwords stored — Firebase manages token lifecycle
• ID tokens auto-refresh every 55 minutes
• onAuthStateChanged listener keeps session state reactive

• Frontend: Firebase SDK handles token refresh transparently
• Cloud Functions: onCall trigger auto-verifies Firebase ID token — no manual verification needed
• Firestore: Security rules check request.auth != null on every operation

• initializeAppCheck with ReCaptchaV3Provider initialized in src/firebase.ts
• Every request to Firebase services includes an App Check token
• Protects against abuse from stolen Firebase config keys
• Requires VITE_RECAPTCHA_SITE_KEY env var (get from reCAPTCHA Admin)

Every collection enforces owner-based isolation:

allow read: if isAuthenticated() && resource.data.uid == request.auth.uid;
allow create: if isAuthenticated() && isOwner(request.resource.data.uid);
allow update: if isAuthenticated() && isOwner(resource.data.uid) && uidNotModified();

Guarantees:

• User A cannot read, write, or infer data from User B
• uid field cannot be changed by the client (uidNotModified())
• Users can only create documents with their own uid

allow update: if isAuthenticated()
  && !('plan' in request.resource.data)
  && !('status' in request.resource.data)
  && !('currentPeriodEnd' in request.resource.data);
allow delete: if false;

Plan upgrades can ONLY happen through the upgradeToPro Cloud Function (Admin SDK, server-side trusted context).

All user input is sanitized before being sent to Firestore:

sanitizeInput(input, maxLength) — removes XSS vectors from plain text:

• <script> tags and content
• javascript: URIs
• vbscript: URIs
• data:text/html URIs
• Event handlers: onerror=, onclick=, onload=, onmouseover=, etc.
• expression() (CSS IE hack)
• <iframe>, <object>, <embed>, <form> tags

Applied to ALL form fields in useFirestoreMutations:

• Employee: name, position, section, area
• Expense: description
• Inventory: name, category
• Revenue: category, description
• Portfolio: companyName, tagline, description, logoUrl, mission, vision, values

sanitizeMarkdown(html) — DOMPurify wrapper for AI output:

• Whitelist: h1-h6, p, strong, em, b, i, ul, ol, li, code, pre, blockquote, a, br, hr, table, thead, tbody, tr, th, td
• Allowed attrs: href, title, class, target, rel
• Forbidden: onclick, onerror, onload, onmouseover, style, script, iframe, object, embed, form, img
• Used in AiAnalysisModal.tsx and AiTab.tsx

isValidImageUrl(url) — validates image URLs:

• Must be https:// from known safe domains (googleusercontent.com, firebaseapp.com, github.com, etc.)
• Used for user.photoURL in Sidebar

Each collection has a validation function that runs on every write:

src/utils/importExport.ts validates every record before writing to Firestore:

• Type checks for all fields
• String length limits
• Enum validation
• Numeric range validation
• Max 500 records per import (DoS prevention)

functions/src/index.ts — three layers of validation:

1. Rate Limiting: 10 requests/minute per uid, in-memory Map with 5-min cleanup
2. Input Sanitization: Removes prompt injection patterns (IGNORE, DISREGARD, SYSTEM PROMPT, OVERRIDE, PREVIOUS INSTRUCTION)
3. Payload Validation: Type guards (isValidAnalyzePayload, isValidStrategicPayload) check every field type and range

No dangerouslySetInnerHTML used anywhere in the codebase.

Configured in firebase.json hosting headers:

All <script> and <link> tags in the production index.html include integrity="sha384-..." and crossorigin="anonymous" attributes.

Generated by a custom Vite plugin (sriHashPlugin in vite.config.ts) that:

1. Hashes each JS/CSS chunk with SHA-384 during build
2. Injects integrity attributes into the HTML output
3. Ensures tampered scripts are rejected by the browser

CSRF is mitigated by the architecture:

• Firebase Auth uses Bearer tokens, not cookies — no CSRF token needed
• Cloud Functions onCall use Firebase ID tokens, not session cookies
• Firestore SDK uses tokens, not sessions
• No server-side sessions that could be exploited via CSRF

The AI proxy uses multiple defenses:

"Você é um consultor de RH sênior. Analise o desempenho do funcionário...
Responda apenas com a análise profissional."

System instructions are set server-side and cannot be overridden by user input.

function sanitizeInput(value: string, maxLength: number): string {
  return value
    .slice(0, maxLength)
    .replace(/(?:IGNORE|DISREGARD|NEW\s*INSTRUCTION|SYSTEM\s*PROMPT|OVERRIDE|PREVIOUS\s*INSTRUCTION)/gi, "")
    .trim();
}

All string inputs are truncated to their maximum allowed length, preventing oversized payloads.

src/components/ErrorBoundary.tsx catches React render errors and displays a generic fallback ("Ops! Algo deu errado") — no error details exposed to users. Details logged to console only.

src/utils/currency.ts — handleFirestoreError() logs operation type, collection path, and auth info (without PII) for debugging.

• Auth failures → unauthenticated
• Rate limit → resource-exhausted
• Invalid input → invalid-argument
• All errors use Firebase's standard HttpsError types

• Firebase config values (project ID, API key, app ID) — these are public by design
• VITE_RECAPTCHA_SITE_KEY — reCAPTCHA v3 site key for App Check
• VITE_GEMINI_API_KEY — DEPRECATED, no longer used

• GEMINI_API_KEY — set via firebase functions:config:set gemini.api_key, never committed to repo

The vite.config.ts no longer bakes GEMINI_API_KEY into the client bundle. All AI calls go through Cloud Functions with server-side key.

The file .env.local contains real Firebase credentials and is committed to the repository. This should be:

1. Added to .gitignore
2. Credentials rotated
3. New credentials set via environment variables

1. Rotate Firebase API key in Google Cloud Console
2. Rotate Gemini API key
3. Update .env.local and redeploy
4. Add .env.local to .gitignore

• User sees: "Rate limit exceeded. Try again later."
• Cloud Function returns resource-exhausted error
• Frontend displays toast notification

• Check browser console for permission-denied error
• Verify uid matches authenticated user
• Verify all required fields pass validation functions

• Frontend sanitizeInput strips the payload silently
• CSP blocks inline script execution
• SRI prevents tampered script loading
• Log the attempt for investigation