Security
Security groups ERPat's built-in protection layer — roles and permissions, sign-in guards, the request middleware pipeline, access rules, and the audit trail — into one recognizable module. The protection itself is delivered by ERPat's core; this module registers Security in Manage Modules and on the public homepage.
What it protects
- Roles & permissions — grant access per role (Disable / All / Specific) in Settings → Roles.
- Authentication guards — staff, client, customer, and guest audiences.
- Middleware pipeline — secure headers, input sanitization, CSRF, rate limiting, IP restriction, and file-upload security.
- Audit log — a record of sensitive actions for review and compliance.
Good to know
- Security is always-on — it is not switched off by a module toggle.
- The implementation lives in core (
application/guards/,application/middleware/,application/controllers/Roles.php); this package is metadata and configuration only.