# Skulitech ERP hardening release — 13 July 2026

This release implements the principal critical, high and medium findings from the static system audit and adds further workflow hardening found during remediation testing.

## Implemented corrections

- Secured profile, institutional-branding and ID-card image uploads.
- Added upload-directory execution protection and private storage controls.
- Removed public SQL, logs, historical reports and diagnostic files from the production root.
- Strengthened application tracking with a second verification value, masked personal information, failed-attempt throttling and signed admission-letter links.
- Corrected independent session and module filters in reporting.
- Converted timetable deletions to permission-checked, CSRF-protected POST actions.
- Added numbered migrations, a current clean-install schema and deployment CLI commands.
- Added relational foreign keys for core academic, audit, finance, library and clearance relationships.
- Corrected seeded academic-year, session and module values.
- Replaced destructive user deletion with deactivation/reactivation and protected the current/last administrator.
- Centralised competency thresholds and password policy.
- Removed query-string API tokens and the non-functional “Remember me” option.
- Moved diagnostic snapshots to private storage and added an authorised download controller.
- Added security headers, secure session-cookie defaults, locally bundled Bootstrap, Bootstrap Icons and jQuery assets, and product-brand consistency.
- Converted additional destructive academic, admission, examination and lecturer actions from GET links to CSRF-protected POST forms.
- Added identifier and IP-based throttling plus honeypot protection for public applications, tracking and password-reset requests.
- Corrected an academic-year default that incorrectly used the active session value in student progression.

## Verification boundary

All PHP files, the main JavaScript file, local asset references and static schema checks are validated during packaging. A full browser/database acceptance test still requires a deployment environment with MySQL/MariaDB, PDO MySQL, HTTPS and realistic institutional roles/data.

## Sponsor funds and accrual accounting extension

- Added configurable HELB, County bursary, NG-CDF bursary, scholarship and other sponsor funding sources.
- Added optional accrued sponsor awards and sponsor receivable recognition.
- Added one official sponsor bank/cheque receipt with globally unique transaction-reference protection.
- Added manual, CSV and Excel bulk allocation of one receipt to many student accounts.
- Added receipt-to-allocation controls, reserved batch balances, expected-schedule validation, approval and reversal workflows.
- Added non-cash sponsor credits to student fee statements without increasing bank/cashier receipts.
- Added sponsor receipts, batch allocation registers, opening/period/closing sponsor control reports and IPSAS-oriented sponsor disclosures.
- Expanded the chart of accounts for sponsor receivables, restricted/unallocated funds, prepayments, PPE, accumulated depreciation, employee benefits, deferred income, grants/transfers and depreciation expense.
- Added sponsor-fund integrity checks and the `finance_sponsors` role privilege.

This extension supports accrual and IPSAS-oriented reporting but does not replace institution-specific accounting policies, opening-balance validation, year-end adjustments, disclosure notes or external audit.
