diff --git a/docs/security/SECURITY_CHECKLIST.md b/docs/security/SECURITY_CHECKLIST.md
index bc80dc2..5ae6e69 100644
--- a/docs/security/SECURITY_CHECKLIST.md
+++ b/docs/security/SECURITY_CHECKLIST.md
@@ -32,6 +32,33 @@ unstated gets skipped the first time it is inconvenient.>
 - [ ] Every input that reaches a query or a filesystem path is validated at the boundary
 - [ ] Dependencies audited, and any accepted advisory recorded with a reason
 
+### Authorisation — the three questions login does not answer
+
+- [ ] Every authenticated endpoint refuses a logged-out caller — proves the check is on the server, not a hidden button
+- [ ] Every object fetched by id is scoped to the caller, and every list endpoint returns only that caller's rows — proves no IDOR, and that a response is not quietly serving the whole table
+- [ ] Every privileged route checks a role rather than a session — proves *authenticated* has not been mistaken for *permitted*
+
+### What the browser is handed
+
+- [ ] No secret in the built client bundle, not merely none in the repository — proves the scan reached the artifact users actually receive
+- [ ] Session tokens in `HttpOnly` cookies rather than `localStorage` — proves one XSS is not an account takeover
+- [ ] Response headers carry a CSP and a frame policy, and nothing is served over plain HTTP — proves clickjacking and injection meet resistance
+
+### What a stranger can learn or exhaust
+
+- [ ] Authentication and reset responses do not reveal whether an account exists — proves the login path cannot be used to enumerate users
+- [ ] *(precautionary)* Authentication is rate-limited, as is anything costing money per request, and spend alerts somewhere a person reads — proves a brute-force or a bill cannot run unattended overnight
+
+### The compliance bar, which is not the launch bar
+
+- [ ] There is a record of who changed what, and when — proves the question an auditor or a customer eventually asks can be answered at all
+- [ ] There is an environment that is not production to test against
+
+The last two are a different bar from everything above them. The rest of this
+list gets a release out of the door; those two get it through the first
+compliance review, and it is worth knowing which one this project is building
+for before somebody asks.
+
 ## What got past this list
 
 <Add an entry whenever a real finding was not caught here, and then add the check