RischioLegale - Piattaforma di Analisi Legale Automatizzata

Il Contesto

Dal POC Legacy all'Enterprise

Migrazione critica da sistema monolitico a architettura modulare

Sistema Legacy (POC)

Critico

API Keys Hardcoded
Credenziali OpenAI e Groq esposte nel codice sorgente
Monolite Python
11.559 righe in 4 file - functions.py ha 10.615 righe!
Zero Test Coverage
Nessun test automatizzato per la logica di business
Nessun GDPR
Dati personali non anonimizzati, no audit trail
No Caching
Ogni richiesta AI costa tempo e denaro
Path Hardcoded
Percorsi file fissi nel codice, vulnerabili a path traversal

Struttura Legacy

functions.py 10,615 righe

main.py 403 righe

db.py 350 righe

gpu_worker.py 191 righe

Migrazione

Nuovo Sistema Enterprise

Target

Secrets via Environment
Zero credenziali nel codice, gestione sicura
Clean Architecture
47 moduli indipendenti con contratti definiti
85% Test Coverage
TDD con Pest 4, test unitari, feature e browser
GDPR Compliant
Anonimizzazione PII, audit trail, data retention
Cache Multilivello
L1 Memory, L2 Redis, L3 Database - 70% più veloce
Laravel 12 + TALL Stack
Framework moderno con Livewire, Alpine, Tailwind

Stack Tecnologico

PHP 8.4 Laravel 12 Livewire 3 Tailwind 4 Redis

Roadmap

Timeline del Progetto

5 Milestones verso il go-live del 30 Gennaio 2026

DEADLINE CRITICA: 30 Gennaio 2026

Zero buffer temporale - Il progetto DEVE essere completato entro questa data

M1

Sicurezza

17/11 - 23/11/2025 7 giorni

Eliminazione vulnerabilità critiche e hardening del sistema

Rimozione secrets hardcoded
Validazione input (Form Requests)
Security headers (HSTS, CSP, X-Frame)
Validazione file upload + malware scan
Security audit completo

FR-M1-001 FR-M1-002 FR-M1-003 FR-M1-004 FR-M1-005 FR-M1-006 FR-M1-007

Completato

M2

Architettura Core

24/11 - 14/12/2025 21 giorni

Implementazione dei 5 moduli core con Clean Architecture

Privacy/GDPR Module
Document Management Module
Text Processing Module
AI Integration Module
Legal Analysis Module

FR-M2-001 FR-M2-002 FR-M2-003 FR-M2-004 FR-M2-005 FR-M2-006 FR-M2-007 FR-M2-008

In Corso

M3

Performance

15/12/2025 - 10/01/2026 27 giorni*

Ottimizzazione per raggiungere il 70% di miglioramento

Cache multilivello (L1/L2/L3)
Query optimization + indexing
Streaming file grandi
Queue workers asincroni
Performance benchmarking

FR-M3-001 FR-M3-002 FR-M3-003 FR-M3-004 FR-M3-005 FR-M3-006 FR-M3-007

* Include periodo natalizio

Pianificato

M4

Testing & Quality

11/01 - 24/01/2026 14 giorni

Raggiungimento 85% coverage e CI/CD pipeline

Unit tests (business logic)
Feature tests (user journeys)
Browser tests (Pest 4)
Security tests (OWASP Top 10)
CI/CD pipeline setup

FR-M4-001 FR-M4-002 FR-M4-003 FR-M4-004 FR-M4-005 FR-M4-006 FR-M4-007

Pianificato

M5

Privacy & Docs

25/01 - 30/01/2026 6 giorni

Verifica GDPR compliance e documentazione completa

PII anonymization completa
Audit trails verification
Data retention & purging
Right to erasure
Documentazione tecnica

FR-M5-001 FR-M5-002 FR-M5-003 FR-M5-004 FR-M5-005 FR-M5-006 FR-M5-007

Pianificato

GO-LIVE

30 Gennaio 2026

Deployment in produzione del sistema enterprise-ready

Requirements

User Stories

5 User Stories prioritizzate che guidano lo sviluppo del progetto

P1 M1

Secure System Access

Accesso Sicuro al Sistema

As a legal analyst,

I need to access the platform without risk of data breaches

So that sensitive legal documents remain protected.

Why This Priority

The legacy system has exposed API keys and hardcoded credentials. This is a critical security vulnerability that must be resolved before any other work.

Independent Test

Can be fully tested by attempting to find any hardcoded credentials in the codebase and verifying all secrets are loaded from secure configuration.

Acceptance Scenarios

Given a clean checkout of the codebase

When I search for API keys or passwords

Then zero hardcoded credentials are found

Given the application is running

When I access any endpoint

Then all API calls use credentials from environment variables

Given a malicious input attempt

When I submit unvalidated data

Then the system rejects it with appropriate error messages

Success Criteria

SC-M1-001 Zero hardcoded credentials found in codebase (automated scan passes)
SC-M1-002 100% of user inputs validated before processing
SC-M1-003 Security audit completes with zero critical or high vulnerabilities

Requirements

FR-M1-001 FR-M1-002 FR-M1-003 FR-M1-004 FR-M1-005 FR-M1-006 FR-M1-007

P2 M2

Document Analysis with Clean Architecture

Analisi Documenti con Clean Architecture

As a legal analyst,

I need to upload and analyze legal documents through a well-organized system

So that I can efficiently process cases.

Why This Priority

Core business functionality depends on proper module architecture. Without this, all other features cannot be built reliably.

Independent Test

Can be fully tested by uploading a document and receiving analysis results through the new modular system.

Acceptance Scenarios

Given a legal document

When I upload it to the system

Then it is processed through the Document Management module

Given an uploaded document

When text extraction completes

Then the Text Processing module normalizes and tokenizes content

Given processed text

When AI analysis is requested

Then the AI Integration module returns insights via abstracted service

Given AI insights

When legal analysis runs

Then the Legal Analysis module provides risk scoring and recommendations

Success Criteria

SC-M2-001 5 core modules (Privacy, Document, Text, AI, Legal) operational and independently testable
SC-M2-002 Zero circular dependencies detected by static analysis
SC-M2-003 All inter-module communication uses defined contracts

Requirements

FR-M2-001 FR-M2-002 FR-M2-003 FR-M2-004 FR-M2-005 FR-M2-006 FR-M2-007 FR-M2-008

P3 M3

Fast Response Times

Tempi di Risposta Rapidi

As a legal analyst,

I need the system to respond quickly

So that I can process more cases efficiently.

Why This Priority

Performance directly impacts user productivity. The 70% improvement target addresses current slow response times.

Independent Test

Can be fully tested by measuring response times before and after caching implementation.

Acceptance Scenarios

Given a repeated analysis request

When the same document is analyzed twice

Then the second request returns 70% faster due to caching

Given multiple concurrent users

When 100 users access the system simultaneously

Then response times remain under 2 seconds

Given a large document queue

When batch processing runs

Then operations complete without blocking user interactions

Success Criteria

SC-M3-001 Average page load time reduced by 70% compared to baseline measurements
SC-M3-002 System supports 100 concurrent users with response times under 2 seconds
SC-M3-003 Repeated AI requests return from cache in under 100ms

Requirements

FR-M3-001 FR-M3-002 FR-M3-003 FR-M3-004 FR-M3-005 FR-M3-006 FR-M3-007

P4 M4

Reliable System Behavior

Comportamento Affidabile del Sistema

As a system administrator,

I need comprehensive test coverage

So that deployments don't introduce regressions.

Why This Priority

Quality assurance prevents costly bugs in production. 85% coverage target ensures system reliability.

Independent Test

Can be fully tested by running the test suite and verifying coverage metrics.

Acceptance Scenarios

Given the complete test suite

When tests run

Then at least 85% of code is covered

Given a code change

When CI/CD pipeline executes

Then all tests pass before deployment is allowed

Given browser tests

When critical user journeys are tested

Then UI interactions work correctly end-to-end

Success Criteria

SC-M4-001 Code coverage reaches minimum 85%
SC-M4-002 CI/CD pipeline executes all tests on every commit
SC-M4-003 Zero test failures in main branch

Requirements

FR-M4-001 FR-M4-002 FR-M4-003 FR-M4-004 FR-M4-005 FR-M4-006 FR-M4-007

P5 M5

GDPR-Compliant Data Handling

Gestione Dati Conforme GDPR

As a data protection officer,

I need the system to automatically handle personal data according to GDPR

So that we remain legally compliant.

Why This Priority

Legal compliance is mandatory for EU operations. This milestone ensures the platform meets all regulatory requirements.

Independent Test

Can be fully tested by verifying PII is anonymized, audit trails exist, and data retention policies are enforced.

Acceptance Scenarios

Given a document containing personal data

When it is stored

Then all PII is automatically anonymized

Given any data access event

When it occurs

Then an audit trail entry is created without storing PII

Given data older than retention period

When purge job runs

Then expired data is permanently deleted

Given a user deletion request

When processed

Then all user data is erased within 30 days

Success Criteria

SC-M5-001 100% of stored documents have PII anonymized
SC-M5-002 Audit trail captures all data access events
SC-M5-003 Data retention policy automatically purges expired records
SC-M5-004 GDPR compliance checklist fully satisfied

Requirements

FR-M5-001 FR-M5-002 FR-M5-003 FR-M5-004 FR-M5-005 FR-M5-006 FR-M5-007

Edge Cases

AI service (OpenAI/Groq) unavailable

System falls back to secondary provider, then to basic analysis mode

Malformed documents

Validation rejects with clear error message, document is not processed

Anonymization fails to detect PII

Conservative approach: flag document for manual review

Caching stale data

TTL-based invalidation with manual purge capability

Test coverage drops below threshold

CI/CD pipeline blocks deployment until resolved

Architecture

Architettura del Sistema

Clean Architecture con 4 layer e 47 moduli specializzati

Presentation Layer

Livewire 3 Volt Alpine.js Flux UI

Componenti reattivi per l'interfaccia utente

API Gateway

Laravel 12 Sanctum CORS Rate Limiting

Autenticazione, autorizzazione e routing API

Application Core

Text Processing

Legal Analysis

ML Inference

Privacy & Security

Caching

Data Repository

AI Integration

Document Processing

Infrastructure Layer

MySQL/PostgreSQL Redis Cache File Storage Queue Workers

Database, cache, storage e code asincrone

Flusso Dati

User Input

Validation

Anonymization

Text Processing

ML Inference

Legal Analysis

Risk Assessment

Report

Core Modules

I 5 Moduli Core

Architettura modulare con interfacce e contratti definiti

Privacy & GDPR Module

Gestione completa della conformità GDPR

Services

AnonymizerService

Rilevazione e anonimizzazione automatica PII

Email → [EMAIL]
Telefono → [TELEFONO]
Nome → [NOME]
Codice Fiscale → [CF]
IBAN → [IBAN]

AuditService

Audit trail per tutte le operazioni di scrittura

Log senza PII
Retention 2 anni minimo
Spatie Activity Log

Interfaces

interface AnonymizerInterface {
    public function anonymize(string $text): string;
    public function detectPII(string $text): array;
}

interface AuditInterface {
    public function log(string $event, Model $subject): void;
    public function getLogsFor(Model $subject): Collection;
}

Document Management Module

Gestione upload, storage e versioning documenti

Services

UploadService

Upload sicuro con validazione

Formati: PDF, DOCX
Max size: 50MB
Malware scanning
MIME type validation

DocumentService

CRUD e versioning documenti

Storage path criptato
Content hash (SHA-256)
Sensitivity levels
Retention policies

Interfaces

interface DocumentServiceInterface {
    public function store(UploadedFile $file, array $metadata): LegalDocument;
    public function find(int $id): ?LegalDocument;
    public function delete(int $id): bool;
}

interface UploadServiceInterface {
    public function validate(UploadedFile $file): bool;
    public function process(UploadedFile $file): string;
}

Text Processing Module

Pulizia, normalizzazione e tokenizzazione testo

Services

CleanerService

Pulizia e normalizzazione testo

Rimozione caratteri speciali
Normalizzazione Unicode
Gestione whitespace
Encoding detection

TokenizerService

Tokenizzazione per ML

Sentence splitting
Word tokenization
Stemming italiano
Lemmatization

Interfaces

interface CleanerInterface {
    public function clean(string $text): string;
    public function normalize(string $text): string;
}

interface TokenizerInterface {
    public function tokenize(string $text): array;
    public function sentences(string $text): array;
}

AI Integration Module

Integrazione servizi AI con fallback automatico

Services

OpenAIService

Provider primario - GPT-4

Model: GPT-4o-mini
Cache responses
Token tracking
Cost estimation

GroqService

Provider fallback - Llama 3.3

Model: Llama 3.3 70B
Faster inference
Lower cost

AIServiceManager

Orchestrazione con fallback chain

OpenAI → Groq → Basic
Retry logic
Rate limiting

Interfaces

interface AIServiceInterface {
    public function analyze(string $text, array $options = []): AIResponse;
    public function isAvailable(): bool;
    public function getRateLimitStatus(): RateLimitStatus;
}

Fallback Strategy

OpenAI GPT-4 Primary

Groq Llama Fallback 1

Rule-Based Fallback 2

Legal Analysis Module

Risk scoring, precedent matching e recommendations

Services

RiskScoringService

Calcolo risk score 0.00-1.00

Low: 0.00-0.25
Medium: 0.25-0.50
High: 0.50-0.75
Critical: 0.75-1.00

PrecedentMatchService

Matching con precedenti legali

Italian courts DB
Relevance scoring
Date filtering
Court type filter

Interfaces

interface RiskScoringInterface {
    public function calculateScore(LegalDocument $doc): float;
    public function getRecommendations(float $score): array;
}

interface PrecedentMatchInterface {
    public function findMatches(string $query, array $filters): Collection;
    public function getRelevanceScore(Precedent $p, string $query): float;
}

Security

Sicurezza Enterprise-Grade

Principio I della Constitution: Security-First (NON NEGOZIABILE)

Secret Management

Zero hardcoded credentials
Environment variables
Config validation at boot
.env.example documentation

config('services.openai.key')

Security Headers

HSTS (max-age=31536000)
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Content-Security-Policy
Referrer-Policy

Input Validation

Laravel Form Requests
CSRF protection
XSS via Blade escaping
SQL injection via Eloquent

StoreDocumentRequest::class

File Upload Security

MIME type validation
File size limit (50MB)
Allowed: PDF, DOCX only
Malware scanning (ClamAV)

Authentication

Laravel Sanctum
Role-based access
Session secure cookies
Force HTTPS

OWASP Top 10

Injection prevention
Broken auth protection
Sensitive data encryption
Security testing suite

Security Checklist (Constitution Appendix A)

Compliance

GDPR Compliance

Principio II della Constitution: Conformità GDPR obbligatoria

Audit Trail

Tracciamento completo senza logging di PII

activity()
    ->performedOn($document)
    ->withProperties([
        'action' => 'accessed',
        'resource_type' => 'legal_document',
        'anonymized_id' => $document->anonymized_id,
    ])
    ->log('Document accessed');

Spatie Activity Log
Retention 2 anni minimo
No PII in properties
DPO access only

Classificazione Dati

PUBLIC

Pubblico

Dati non sensibili, condivisibili

Encryption at rest

CONFIDENTIAL

Confidenziale

Dati business-sensitive

Encryption
Access logging

RESTRICTED

Ristretto

PII e documenti legali

Encryption
Anonymization
Audit trail
Retention policy

Tech Stack

Stack Tecnologico

TALL Stack con le ultime versioni di ogni componente

Stack Principale

PHP 8.4.14

Ultima versione con JIT compiler

Laravel 12.x

Framework PHP enterprise

Livewire 3 + Volt

Componenti full-stack reattivi

Alpine.js 3.x

Interattività frontend leggera

Tailwind CSS 4.x

Utility-first CSS framework

Flux UI Free 2.x

Component library per Livewire

Testing & Quality

Pest 4.x

Testing moderno con browser testing

Larastan 3.x

Analisi statica (Level 8)

Laravel Pint

Code formatting automatico

Rector 2.x

Refactoring automatico

Monitoring & Debug

Laravel Pulse

Real-time performance monitoring

Laravel Telescope

Debug assistant per development

Scramble

Auto-generated API docs

AI & Machine Learning

OpenAI GPT-4

Provider AI primario

Groq (Llama 3.3)

Provider AI fallback

Custom ML Models

BERT variants per testo legale italiano

Infrastructure

MySQL/PostgreSQL

Database relazionale

Redis

Cache L2 e Queue

Docker

Containerization

Performance Targets

70%

Riduzione Load Time

vs Legacy POC

<2s

Response Time

100 concurrent users

<100ms

Cache Hit

AI responses

85%

Test Coverage

Minimum required

Multi-Level Cache Strategy

L1

Memory/Array

In-request cache

TTL: 5 min

L2

Redis

Shared cache cross-workers

TTL: 1 ora

L3

Database

Persistent cache

TTL: 24 ore

API Reference

API Contracts

OpenAPI 3.0 - RESTful API con autenticazione Sanctum

Documents API

Gestione documenti legali con GDPR compliance

/api/v1/documents

GET /documents Lista documenti paginata

page per_page status sensitivity case_id

POST /documents Upload documento

multipart/form-data: document, case_id, sensitivity, retention_days

GET /documents/{id} Dettaglio documento

DELETE /documents/{id} Elimina documento (GDPR erasure)

GET /documents/{id}/download Download file originale

POST /documents/{id}/analyze Avvia analisi AI

202 Accepted: { job_id: uuid }

Analysis API

Analisi legale e risk assessment

/api/v1/analyses

GET /analyses Lista analisi

document_id risk_level date_from date_to

GET /analyses/{id} Dettaglio analisi con recommendations

GET /analyses/{id}/report Genera report PDF/HTML

format=pdf|html

GET /analyses/statistics Statistiche dashboard

period=day|week|month|year

POST /precedents/search Ricerca precedenti legali

{ query, court_types[], date_from, date_to, limit }

Privacy API

Operazioni GDPR compliance

/api/v1/privacy

POST /privacy/export Richiedi export dati (portabilità)

{ format: json|csv, include_documents, include_analyses }

GET /privacy/export/{job_id} Stato export

GET /privacy/export/{job_id}/download Download export completato

POST /privacy/erasure Richiedi cancellazione dati

{ confirmation: "DELETE ALL MY DATA", reason }

GET /privacy/consent Stato consensi

PUT /privacy/consent Aggiorna consensi

{ data_processing, ai_analysis, marketing }

GET /audit/logs Audit logs (DPO only) DPO

Data Schemas

Document

{
  id: integer,
  case_id: uuid,
  original_filename: string,
  sensitivity: enum,
  status: enum,
  file_size_bytes: integer,
  retention_days: integer,
  purge_at: datetime,
  created_at: datetime
}

Analysis

{
  id: integer,
  document_id: integer,
  risk_score: float(0-1),
  risk_level: enum,
  confidence_score: float,
  recommendations: array,
  precedents: array,
  ai_provider: enum,
  created_at: datetime
}

AuditLog

{
  id: integer,
  log_name: string,
  description: string,
  subject_type: string,
  subject_id: integer,
  causer_id: integer,
  event: string,
  properties: object,
  created_at: datetime
}

Implementation

Tasks Breakdown

196 tasks organizzati in 8 fasi di implementazione

196

Tasks Totali

108

Parallelizzabili

88

Sequenziali

8

Fasi

Phase 1

Setup

Project initialization

9 tasks 7 parallel

T001 Verify PHP 8.4.14 and extensions
T002 Run composer install
T003 Run npm install
T004 Configure .env
T005 Create database
T006 Configure Redis
T007 Run migrations
T008 Verify Pint config
T009 Verify Larastan config

Phase 2

Foundational

Blocking prerequisites - CRITICAL

25 tasks 18 parallel

Database Schema

T010 Add role to users migration
T011 Create legal_documents migration
T012 Create legal_analyses migration
T013 Create ai_responses migration
T014 Run migrations

Models & Factories

T015-T018 Create Eloquent Models
T019-T022 Create Model Factories

Enums

T023-T027 Create Enums (UserRole, Sensitivity, Status, Risk, Provider)

Phase 3

M1 Security

MVP First - Security hardening

23 tasks 14 parallel

Tests (TDD - Write First!)

T033 NoHardcodedCredentialsTest
T034 InputValidationTest
T035 SecurityHeadersTest
T036 CSRFProtectionTest
T037 FileUploadValidationTest

Implementation

T038-T041 Secret Management
T042-T045 Form Requests
T046-T048 Security Headers Middleware
T049-T051 File Upload Security

Phase 4

M2 Architecture

5 Core Modules implementation

40 tasks 24 parallel

T061-T065 Privacy Module
T066-T070 Document Module
T071-T075 TextProcessing Module
T076-T080 AI Module
T081-T085 Legal Module

Phase 5

M3 Performance

70% improvement target

23 tasks 8 parallel

T099-T102 Multi-Level Caching
T103-T106 Query Optimization
T107-T108 Streaming & Memory
T109-T113 Async Processing
T114-T116 Performance Verification

Phase 6

M4 Testing

85% coverage target

26 tasks 18 parallel

T117-T119 Test Infrastructure
T120-T124 Unit Tests
T125-T128 Feature Tests
T129-T132 Browser Tests
T133-T135 Security Tests
T136-T139 CI/CD Pipeline

Phase 7

M5 Privacy

GDPR verification

30 tasks 10 parallel

T143-T146 Privacy Tests (TDD)
T147-T152 PII Anonymization
T153-T156 Audit Trails
T157-T159 Data Retention
T160-T163 Right to Erasure
T164-T169 Privacy API Endpoints
T170-T172 GDPR Verification

Phase 8

Polish

Final validation & docs

17 tasks 5 parallel

T173-T177 Documentation
T178-T183 Final Verification
T184-T186 Deployment Preparation

Phase Dependencies

Setup

Foundation

M1 SecurityMVP

M2 Arch

M3 Perf

M4 Test

M5 Privacy

Polish

Database

Data Model

Entità principali con supporto GDPR built-in

User

id bigint PK

name string

email string unique

role enum

deleted_at timestamp

hasMany: LegalDocument, AuditLog

1

N

LegalDocument

id bigint PK

user_id bigint FK

case_id uuid indexed

sensitivity enum

status enum

hasMany: LegalAnalysis

1

N

LegalAnalysis

id bigint PK

document_id bigint FK

risk_score decimal(3,2)

risk_level enum

recommendations json

ai_provider string

AuditLog

subject_type/id polymorphic

causer_type/id polymorphic

event string

AIResponse

Cache

cache_key string unique

provider enum

response_content text

cost_usd decimal

expires_at timestamp

Enumerations

UserRole

analyst admin dpo

DocumentSensitivity

public confidential restricted

DocumentStatus

pending processing analyzed archived failed

RiskLevel

low medium high critical

AIProvider

openai groq fallback

Team

Team & Contatti

Il team di sviluppo di RischioLegale

Mircha Emanuel D'Angelo

Tech Lead

Responsabile architettura e decisioni tecniche

Andrea Margiovanni

Product Owner

Responsabile requisiti e prioritizzazione

Contatti

tech@oltrematica.it

Teams: LexCapital - RischioLegale

Constitution Principles

I

Security-First

NON NEGOZIABILE - Ogni feature deve essere sicura by design

II

GDPR Compliance

Obbligo legale per dati cittadini EU

III

Clean Architecture

Moduli self-contained con interfacce definite

IV

Test-Driven Development

85% coverage minimo - NON NEGOZIABILE

V

Performance

70% riduzione tempi di caricamento

Dal POC Legacy all'Enterprise

Sistema Legacy (POC)

Struttura Legacy

Nuovo Sistema Enterprise

Stack Tecnologico

Timeline del Progetto

Sicurezza

Architettura Core

Performance

Testing & Quality

Privacy & Docs

30 Gennaio 2026

User Stories

Secure System Access

Why This Priority

Independent Test

Acceptance Scenarios

Success Criteria

Requirements

Document Analysis with Clean Architecture

Why This Priority

Independent Test

Acceptance Scenarios

Success Criteria

Requirements

Fast Response Times

Why This Priority

Independent Test

Acceptance Scenarios

Success Criteria

Requirements

Reliable System Behavior

Why This Priority

Independent Test

Acceptance Scenarios

Success Criteria

Requirements

GDPR-Compliant Data Handling

Why This Priority

Independent Test

Acceptance Scenarios

Success Criteria

Requirements

Edge Cases

Architettura del Sistema

Presentation Layer

API Gateway

Application Core

Infrastructure Layer

Flusso Dati

I 5 Moduli Core

Privacy & GDPR Module

Services

Interfaces

Document Management Module

Services

Interfaces

Text Processing Module

Services

Interfaces

AI Integration Module

Services

Interfaces

Fallback Strategy

Legal Analysis Module

Services

Interfaces

Sicurezza Enterprise-Grade

Secret Management

Security Headers

Input Validation

File Upload Security

Authentication

OWASP Top 10

Security Checklist (Constitution Appendix A)

GDPR Compliance

Diritti degli Interessati

Accesso

Rettifica

Cancellazione