RCI V18 INSTITUTIONAL TRUST

Close production security gaps before adding more complexity.

V18 is a regression, repair and hardening release built on V17. It replaces public self-selection of privileged roles with expiring invitations, enforces account status during sign-in and active sessions, invalidates old sessions after password changes, fixes nested authentication redirects, introduces role-aware staff workspaces and corrects Apache rules that could block legitimate public JSON resources.

Trusted Delivery Global Governance Status →

V18 SECURITY REMEDIATION

Security that survives real hosting behavior.

Invitation-only staffTeacher, school and privileged staff accounts require expiring invitations.

Session revocationPassword changes and account-status changes invalidate older sessions.

Correct role routingPartner, support, finance and safeguarding users land in the right workspace.

Protected internalsConfig, migrations, tests, workers and database tooling are denied over HTTP.

Public JSON restoredOpenAPI, SBOM, release manifests and literacy JSON remain available on Apache.

Browser hardeningHSTS, frame protection, permissions controls and report-only CSP.

trustsecurityinstitutions

Public Accounts

Learner and parent accounts can self-register. Privileged roles cannot.

Professional Invitations

Tenant-scoped, hashed, expiring invitation tokens provision professional roles.

Disabled Accounts

Disabled users are rejected at login and on subsequent protected requests.

Password Changes

Password resets increment an authentication version, revoking previous sessions.

Shared Hosting

Apache/cPanel-sensitive rules are explicitly tested rather than inferred from PHP's development server.

Fresh Deployment

V18 receives its own hashed static assets and service-worker cache namespace.