# Security Checklist (MVP Pre-Production)

- [x] Access JWT is memory-only in frontend state (no sessionStorage/localStorage persistence).
- [x] Refresh token is HttpOnly/Secure/SameSite cookie on `/api/v1/auth` path.
- [x] Auth endpoints implemented with neutral anti-enumeration messaging.
- [x] Origin/Referer validation is enforced for auth endpoints.
- [x] Authenticated/admin route guards and role checks are enforced, including `SUPERUSER_ONLY` checks for critical endpoints.
- [x] Content sanitization is enabled for CMS HTML body.
- [x] Security headers configured in `infra/nginx/default.conf`.
- [x] CI includes dependency audit, Bandit, and gitleaks scans.
- [x] Settings runtime supports `data/compton_settings.json` with env lock behavior.
- [x] Admin audit feed is persisted to `data/logs/admin-audit.jsonl`.
- [x] Install secrets bootstrap is enabled (`apps/api/data/secrets/install.env`) and locked after first run.
- [x] Database, Redis and MinIO are internal by default in base docker compose.
- [x] `refresh` validates user status and rate limit is checked before token rotation.
- [x] CMS sanitization enforces allowed URL protocols (`http`, `https`, `mailto`).
- [x] Admin password create/reset uses shared password policy validators.
- [ ] Production docs endpoint switch (`ENABLE_DOCS=false`) validated in staging/prod env.
- [ ] HSTS behavior validated behind TLS ingress in staging/prod.
- [ ] Recovery runbook for lost `install.env` tested (`docs/secrets-recovery.md`).