# Security / RBAC

## RBAC Model
Defined in `config/rbac.php`.

## Security Controls
- Diagnostics are SELECT-only.
- Error handler centralizes runtime exception handling.
- Prepared statements are required for DB writes.

## Hardening Steps
- Enforce HTTPS and secure cookies in production.
- Replace default admin credential immediately.