<?php

/**
 * Prioritized Remediation Roadmap — residual items
 */

return [
    'p1_next_sprint' => [
        'Bind real VirusScanner (ClamAV) in production',
        'Company-scoped exists: rules remaining on web EmployeeController FK fields',
        'Register Razorpay webhook in dashboard; monitor signature failures',
        'Verify APP_DEBUG=false and CORS origins on staging/prod',
    ],
    'p2_backlog' => [
        'Implement MustVerifyEmail for staff accounts',
        'Remove unused spatie/laravel-permission',
        'Introduce API Resources + /api/v1 versioning',
        'Expand Form Request coverage for API controllers',
        'Encrypt Razorpay secrets at rest (move off plain JSON file)',
    ],
    'p3_hardening' => [
        'Optional WAF / Cloudflare bot fight',
        'Central SIEM shipping for AuditLog + laravel.log',
        'Periodic composer audit in CI',
    ],
];