starter-kit/design/security-checklist.md

• ../Up one level
• raw The file itself. Your browser may save it rather than show it.

# Security checklist

Sized to the domain (see CLAUDE.md §0 sensitive-data note). ✅ / ⚠️ / ❌ each, with evidence.

- [ ] **AuthN** — who can sign in; how (password/OTP/2FA/passkey); tested.
- [ ] **AuthZ enforced** — protected routes reject no-session AND spoofed-identity headers, **verified
      against a real exposed config** (not just "the code has a check").
- [ ] **Login hardening** — rate-limit, lockout, session expiry/rotation.
- [ ] **Transport** — HTTPS; secure/HttpOnly cookies (don't keep session tokens in localStorage for
      an exposed deploy).
- [ ] **Secrets** — env/secret store only; never in code or the repo; write-only in any UI, masked on read.
- [ ] **Input validation / injection** — parameterised queries; server-side validation.
- [ ] **Dependencies** — audit clean (no known vulns).
- [ ] **Secret scan** — repo has no committed secrets; `.env` untracked.
- [ ] **Sensitive data** — not in URLs/logs; least-privilege; backups encrypted + restore tested.
- [ ] **Audit trail** — every mutation records who/when/before-after.