kebaikanku.id handles donation transactions, donor contact data, institution accounts, and future AI-assisted conversations. Security should be treated as product functionality, not an afterthought.

Sensitive data:

• Donor name, phone number, email, and transaction history.
• Institution profile data.
• Payment references and reconciliation records.
• Admin session cookies; account password hashes once multi-user self-service auth ships.
• Midtrans server keys and notification payloads.
• Future AI chat logs, receipt photos, and distribution reports.

The controlled pilot uses one ADMIN_PASSWORD from the backend secret store. A successful login creates a signed, time-limited, HttpOnly session cookie; the dashboard never stores the password or a bearer token. Keep ADMIN_SESSION_SECRET separate from the password in production and rotate both after suspected exposure.

Multi-user institution accounts remain a later phase. That phase must hash stored passwords with a modern password hashing algorithm and add role checks.

Midtrans implementation must:

• Verify notification signatures.
• Keep sandbox and production keys separate.
• Treat callbacks as untrusted input until verified.
• Process payment status changes idempotently.
• Avoid logging raw secrets or full donor PII.

See payment-gateway.md.

Allowed origins should be specific in production:

• https://kebaikanku.id
• https://app.kebaikanku.id
• Any managed Cloudflare Pages preview domains intentionally used by the team.

Avoid broad wildcard origins for production deployments.

The API rate-limits public campaign, donation, waitlist, and admin-login routes. Login has a stricter per-IP limit than ordinary public traffic.

Payment callbacks are protected through Midtrans signature verification; do not replace signature verification with IP allowlists.

Future AI features should follow these rules:

• Do not send passwords, bank credentials, or full payment secrets to LLM providers.
• Minimize donor PII in prompts.
• Record whether generated reports were reviewed by a human before publication.
• Provide a way to disable AI processing for self-hosted deployments that require stricter data control.

Logs should include:

• Request ID.
• Route.
• Status code.
• Latency.
• Internal object IDs when needed.

Logs should not include:

• Passwords.
• Session cookies.
• Midtrans server keys.
• Full Authorization headers.
• Full donor contact details unless explicitly needed in secure audit logs.

• ADMIN_PASSWORD and ADMIN_SESSION_SECRET configured outside the repo.
• Admin cookies are HttpOnly, Secure in production, and time-limited.
• Midtrans signature verification implemented and tested.
• CORS locked to production domains.
• Rate limiting added for auth and donation routes.
• Error responses do not leak stack traces or raw database errors.
• Production uses HTTPS.
• Database backups are encrypted or access-controlled.
• Privacy policy matches actual AI/payment/data behavior.