fix api security issues and update pages issue

docs/security/security-verification-plan.md

@@ -0,0 +1,85 @@
+# CodeIgniter 4 Security Verification and Remediation Plan
+
+## Objective
+
+Perform a comprehensive security assessment of the CodeIgniter 4 application, identify vulnerabilities, implement fixes, verify remediation, and produce a complete audit trail of all findings and corrections.
+
+## Mandatory Requirement
+
+Every vulnerability that is fixed must be documented immediately in the remediation report.
+
+No fix may be marked complete without evidence of verification and retesting.
+
+## Scope
+
+- CodeIgniter 4 configuration
+- Controllers
+- Models
+- Views
+- Routes
+- Filters
+- Authentication and Authorization
+- API endpoints
+- Session handling
+- File uploads
+- Composer dependencies
+
+## Steps
+
+1. Environment and Debug Configuration Review
+2. CSRF Protection Verification
+3. XSS Protection Review
+4. SQL Injection Review
+5. Input Validation Review
+6. Authentication Security Review
+7. Authorization Review
+8. Route and Filter Review
+9. File Upload Security Review
+10. Session and Cookie Security Review
+11. Dependency Audit
+12. Secret Scanning
+13. Automated Security Scan (OWASP ZAP)
+14. Manual Abuse Testing
+15. Generate Security Fix Report
+
+## Security Fix Report Requirements
+
+### Executive Summary
+- Assessment date
+- Reviewer
+- Total findings
+- Fixed findings
+- Open findings
+- Overall risk level
+
+### Vulnerability Inventory
+- ID
+- Severity
+- Category
+- Location
+- Status
+
+### Detailed Remediation Record
+- Finding
+- Risk
+- Location
+- Evidence
+- Remediation
+- Before/After code
+- Verification
+- Result
+
+### Deliverables
+- security-verification-plan.md
+- security-fix-report.md
+- security-fix-report.pdf
+- security-findings.json
+
+## Success Criteria
+
+An independent reviewer must be able to:
+- Reproduce findings
+- Verify fixes
+- Audit changes
+- Review remaining risks
+- Approve or reject deployment based on evidence