---

name: security-checklist description: Security review checklist

Security Checklist

Authentication

• Passwords hashed (bcrypt/argon2)
• MFA available
• Session management secure
• Token expiration set

Authorization

• Principle of least privilege
• Role-based access control
• Resource ownership verified

Data Protection

• Sensitive data encrypted
• TLS for transmission
• PII minimized
• Secrets in vault

Input Validation

• All input validated
• SQL injection prevented
• XSS prevented
• CSRF tokens used

Dependencies

• No known vulnerabilities
• Regular updates
• Minimal dependencies

Logging

• No sensitive data logged
• Security events logged
• Log integrity protected

CRITICAL

• Security issues = STOP and escalate immediately