site/docs/security-checklist.md

Security Checklist (MVP Pre-Production)

• Access JWT is memory-only in frontend state (no sessionStorage/localStorage persistence).
• Refresh token is HttpOnly/Secure/SameSite cookie on /api/v1/auth path.
• Auth endpoints implemented with neutral anti-enumeration messaging.
• Origin/Referer validation is enforced for auth endpoints.
• Authenticated/admin route guards and role checks are enforced, including SUPERUSER_ONLY checks for critical endpoints.
• Content sanitization is enabled for CMS HTML body.
• Security headers configured in infra/nginx/default.conf.
• CI includes dependency audit, Bandit, and gitleaks scans.
• Settings runtime supports data/compton_settings.json with env lock behavior.
• Admin audit feed is persisted to data/logs/admin-audit.jsonl.
• Install secrets bootstrap is enabled (apps/api/data/secrets/install.env) and locked after first run.
• Database, Redis and MinIO are internal by default in base docker compose.
• refresh validates user status and rate limit is checked before token rotation.
• CMS sanitization enforces allowed URL protocols (http, https, mailto).
• Admin password create/reset uses shared password policy validators.
• Production docs endpoint switch (ENABLE_DOCS=false) validated in staging/prod env.
• HSTS behavior validated behind TLS ingress in staging/prod.
• Recovery runbook for lost install.env tested (docs/secrets-recovery.md).