vlad
86cc3fa541
Align the project baseline with the latest admin interface styling and layout structure while documenting setup and usage updates in README.
21 lines
1.5 KiB
Markdown
21 lines
1.5 KiB
Markdown
# Security Checklist (MVP Pre-Production)
|
|
|
|
- [x] Access JWT is memory-only in frontend state (no sessionStorage/localStorage persistence).
|
|
- [x] Refresh token is HttpOnly/Secure/SameSite cookie on `/api/v1/auth` path.
|
|
- [x] Auth endpoints implemented with neutral anti-enumeration messaging.
|
|
- [x] Origin/Referer validation is enforced for auth endpoints.
|
|
- [x] Authenticated/admin route guards and role checks are enforced, including `SUPERUSER_ONLY` checks for critical endpoints.
|
|
- [x] Content sanitization is enabled for CMS HTML body.
|
|
- [x] Security headers configured in `infra/nginx/default.conf`.
|
|
- [x] CI includes dependency audit, Bandit, and gitleaks scans.
|
|
- [x] Settings runtime supports `data/compton_settings.json` with env lock behavior.
|
|
- [x] Admin audit feed is persisted to `data/logs/admin-audit.jsonl`.
|
|
- [x] Install secrets bootstrap is enabled (`apps/api/data/secrets/install.env`) and locked after first run.
|
|
- [x] Database, Redis and MinIO are internal by default in base docker compose.
|
|
- [x] `refresh` validates user status and rate limit is checked before token rotation.
|
|
- [x] CMS sanitization enforces allowed URL protocols (`http`, `https`, `mailto`).
|
|
- [x] Admin password create/reset uses shared password policy validators.
|
|
- [ ] Production docs endpoint switch (`ENABLE_DOCS=false`) validated in staging/prod env.
|
|
- [ ] HSTS behavior validated behind TLS ingress in staging/prod.
|
|
- [ ] Recovery runbook for lost `install.env` tested (`docs/secrets-recovery.md`).
|