[nonprofittechy]

The token API exposed the EFSP service key, browser login bypassed CSRF protection, and several proxy paths and document URLs trusted browser input. This change keeps the service key server-side and binds credentialed requests and document fetches to the signed-in account and its draft.

• Require the matching jurisdiction identity and court token for private proxy APIs and submission; restore CSRF checks on browser mutations. Login accepts JSON and no longer echoes malformed credential bodies.
• Validate canonical jurisdictions and literal court, filing, case, and payment codes before credentialed proxy calls. Disable redirects on the affected calls. Fee and submission authentication checks the same session jurisdiction that forwarding uses.
• Rebuild every outgoing document from the draft's stored S3 key and saved selections, including confidentiality codes, for both fee quotes and submission. Generate one-hour presigned URLs and discard browser URLs, nested attachments, page counts, and unknown document properties. Corrections share this boundary.
• Add 54 confidentiality regressions and update existing submission fixtures to contain real draft documents.

Validation: the broad offline application suite passed: 2,315 passed, 16 skipped, 2 deselected, including all 54 new confidentiality regressions. Focused security/service suites also passed (294 passed, 6 skipped), as did all 91 JavaScript tests, ESLint, Ruff lint/format, ty, Bandit, and the migration check. The two exclusions (test_api_response_consistency and test_dev_settings_refuse_to_load_on_a_deployed_host) fail identically on unchanged main under isolated audit settings: they depend on the live EFSP or development-settings initialization. Live-account tests skip without credentials in the isolated run. The repository’s complete standard pre-push Python and JavaScript hooks also passed on this commit.

Claude and Argon independently reviewed the findings and a credential-free source snapshot of the fixes. Their confirmed path-validation and jurisdiction-authentication concerns are addressed; speculative disclosure impacts were not treated as established exploits.

Deployment: patch every exposed environment, then rotate/revoke exposed EFSP service keys and review proxy access logs. This PR does not rotate credentials or verify deployed proxy/Gotenberg egress controls. No database migration is needed.

Related to #345. Continuous scan automation and deployment verification remain separate work.