Ten standing security checks the checklist does not have

null commented

2026-08-17 22:51:04 -05:00

Owner

docs/security/SECURITY_CHECKLIST.md's Standing checks list has four entries. Grep across docs/** finds zero mentions of security headers, token storage, account enumeration, audit trail, test environment, rate limiting or payment reversal.

Add, each stating what it proves, in the file's existing style: logged-out callers refused on every authenticated endpoint; objects and list endpoints scoped to the caller; privileged routes checking a role rather than a session; no secrets in the built bundle; session tokens in HttpOnly cookies rather than localStorage; authentication responses that do not reveal whether an account exists; a CSP and frame policy with nothing on plain HTTP; a record of who changed what and when; a non-production environment to test against; and (precautionary) rate limits on authentication and on anything costing money per request, with spend alerting somewhere a person reads.

The audit-trail and test-environment rows are a different bar from the rest: they are what a compliance review asks for rather than what a launch needs. Given Privacy LLC, that is the bar worth building for.

Verify: docs/security/SECURITY_CHECKLIST.md's Standing checks list contains all ten, each naming what it proves, with precautionary entries marked.

docs/security/SECURITY_CHECKLIST.md's Standing checks list has four entries. Grep across docs/** finds zero mentions of security headers, token storage, account enumeration, audit trail, test environment, rate limiting or payment reversal. Add, each stating what it proves, in the file's existing style: logged-out callers refused on every authenticated endpoint; objects and list endpoints scoped to the caller; privileged routes checking a role rather than a session; no secrets in the built bundle; session tokens in HttpOnly cookies rather than localStorage; authentication responses that do not reveal whether an account exists; a CSP and frame policy with nothing on plain HTTP; a record of who changed what and when; a non-production environment to test against; and *(precautionary)* rate limits on authentication and on anything costing money per request, with spend alerting somewhere a person reads. The audit-trail and test-environment rows are a different bar from the rest: they are what a compliance review asks for rather than what a launch needs. Given Privacy LLC, that is the bar worth building for. Verify: docs/security/SECURITY_CHECKLIST.md's Standing checks list contains all ten, each naming what it proves, with precautionary entries marked.

null added this to the Batch 01 — Production-readiness controls milestone 2026-08-17 22:51:04 -05:00

null added the

P1

label 2026-08-17 22:51:04 -05:00

null referenced this issue from a commit

2026-08-17 22:55:20 -05:00

feat(security): ten standing checks the list did not have

null closed this issue

2026-08-17 22:55:20 -05:00

Ten standing security checks the checklist does not have #4