Grep across docs/** found zero mentions of security headers, token storage,
account enumeration, audit trail, test environment or rate limiting. The
standing list had four entries and stopped at the boundary of the repository.
Grouped by the question each group answers rather than listed flat, because the
grouping is the argument:
- Authorisation, the three questions login does not answer. Logged-out callers
refused, objects and lists scoped to the caller, privileged routes checking a
role. Login is the front door; every room inside needs its own lock.
- What the browser is handed. No secret in the built bundle, session tokens in
HttpOnly cookies rather than localStorage, a CSP and a frame policy with
nothing on plain HTTP.
- What a stranger can learn or exhaust. Responses that do not confirm whether an
account exists, and *(precautionary)* rate limits on authentication and on
anything costing money per request.
- The compliance bar, which is not the launch bar: a record of who changed what
and when, and an environment that is not production to test against. Called
out as a different bar on purpose -- the rest of the list gets a release out
of the door, those two get it through the first compliance review.
Each entry says what it proves, per this file's own rule that a check whose
purpose is unstated gets skipped the first time it is inconvenient.
closes#4
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
9ab57f6c72