VISORA AI V5.6.10 — Demo Connectors + Security Center + Email Token Recovery 1.
Internal Demo connectors Super Admin can select Demo or Live API per centrally managed reputation connector.
Default safe demo modes are seeded for: Google Maps / Places Booking.com Tripadvisor Agoda remains Live by default because its partner feed is contract-specific.
Demo mode: is available only to super_admin; never sends requests to Google/OTA providers; uses VISORA-owned simulated data for smoke testing; is blocked for customer tenants even if their plan includes the provider; can populate sample Booking/Tripadvisor review data for dashboard testing; keeps Google Places demo as live-style place/benchmark data and does not persist simulated public Google reviews as review history.
Before production, switch the provider to Live API and configure official platform credentials. 2.
Account Security Mode Every account now has a Security Mode switch under /security.
When enabled: TOTP or Passkey is required; sign-in requires the second factor; removing the last factor is blocked while Security Mode is required; changes require the current password.
When an authenticated account is not fully protected, VISORA displays a persistent compact warning linking to Security Center.
Super Admin can configure: minimum password length; recent password history; failed-login lockout threshold; temporary lock duration; idle session timeout; absolute session lifetime; password-reset token lifetime; mandatory Super Admin MFA.
Changing platform security policy requires the Super Admin current password. 3.
Password recovery by email token /forgot-password sends a one-time random reset token by system email.
Hardening: 256-bit random token; only SHA-256 token hash is stored in the database; old unused reset tokens are invalidated before a new one is issued; reset request rate limiting; configurable token lifetime (default 60 minutes); recent-password reuse protection; all older login sessions revoked after reset; generic response prevents email-account enumeration.
System SMTP must be configured under Super Admin → System email. 4.
Authentication/session hardening login rate limiting by account/IP buckets; MFA attempt rate limiting; session ID rotation; idle + absolute session expiration; per-user session_version revocation; Secure/HttpOnly/SameSite session cookies on HTTPS; HSTS in production HTTPS; private/authenticated responses marked no-store; active Super Admin accounts are forced into Security Mode by schema repair/migration. 5.
Credential and network security New secret writes no longer fall back to reversible Base64 storage.
VISORA requires: OpenSSL; a strong CREDENTIAL_ENCRYPTION_KEY (32+ chars, not a placeholder); AES-256-GCM for new credentials.
Legacy encrypted/Base64 payloads remain readable for migration compatibility, but new insecure writes are rejected.
Outbound webhook and website-audit requests now reject localhost/private/reserved IP ranges.
The crawler follows redirects manually and validates each redirect target.
DNS resolution is pinned for the outgoing request to reduce SSRF/DNS-rebinding risk.
Tenant backup restore is limited to VISORA ZIP files up to 25 MB, with strict manifest/encrypted-entry size limits. 6.
Deployment file protection Root .htaccess now also blocks direct access to upgrade/checklist/test documentation when the project root is used as the web root.
Production should still point the web server DocumentRoot to /public whenever possible. 7.
Security audit scope The Security Center performs deployment/runtime checks such as HTTPS, production debug mode, application/encryption keys, system email, protected internal paths, OpenSSL credential encryption, account Security Mode coverage and Super Admin MFA coverage.
This is a defensive static/configuration review and does not replace an independent penetration test, dependency audit, WAF review, infrastructure hardening, or live authenticated security assessment.
Migration 017_security_center_demo_connectors.php The migration/schema repair adds: users.security_mode_enabled users.security_mode_updated_at users.password_changed_at users.session_version password_history auth_rate_limits default security policies default internal Demo modes for selected central reputation connectors.