# CodeSentinel Security-Review Checklist

Use this checklist as a practical release-review starting point. It is not a certification, a guarantee of security, or a substitute for a product-specific threat model and qualified security review.

## 1. Scope and threat model

- [ ] State the change, affected users, trust boundaries, and security-sensitive data flows.
- [ ] Identify new routes, background jobs, dependencies, secrets, permissions, and infrastructure changes.
- [ ] Record the expected security properties and the evidence that will prove them.
- [ ] List realistic abuse cases, including an unauthenticated visitor, a regular user, and an administrator.

## 2. Authentication and session handling

- [ ] Confirm authentication is required for every protected page and API operation.
- [ ] Verify login, logout, password recovery, email verification, and session expiry behavior.
- [ ] Check that session tokens and credentials are not exposed in URLs, logs, client markup, or analytics.
- [ ] Test fixation, replay, CSRF, brute force, and account-enumeration scenarios where applicable.

## 3. Authorization and tenant boundaries

- [ ] Authorize on the server for every read and write; do not rely on hidden UI controls.
- [ ] Test horizontal access: one user cannot read or modify another user's records.
- [ ] Test vertical access: regular users cannot invoke administrator operations.
- [ ] Confirm object identifiers, filters, exports, and bulk operations cannot bypass scope checks.

## 4. Input, output, and browser protections

- [ ] Validate untrusted input with an explicit schema at every external boundary.
- [ ] Check output encoding and rendering for XSS, injection, unsafe HTML, and open redirects.
- [ ] Review file uploads, size/type limits, path handling, and content serving behavior.
- [ ] Confirm security headers, CSP, cookie flags, CORS, and frame-embedding behavior match the threat model.

## 5. Data protection and observability

- [ ] Minimize collection and retention of personal, payment, credential, and sensitive business data.
- [ ] Confirm encryption in transit and at rest where required, plus safe key and secret handling.
- [ ] Ensure logs and errors redact tokens, passwords, personal data, and raw request bodies.
- [ ] Verify alerts, audit events, and failure telemetry are useful without becoming a data leak.

## 6. Dependencies and delivery

- [ ] Review dependency diffs, lockfile integrity, known vulnerabilities, and package provenance.
- [ ] Check CI permissions, build scripts, artifact contents, and deployment configuration for secret exposure.
- [ ] Run relevant static analysis, tests, dependency scanning, and abuse-case checks.
- [ ] Confirm the release can be rolled back and that security-relevant migrations preserve data safely.

## 7. Findings and sign-off

- [ ] Capture each finding with severity, impact, reproduction steps, evidence, owner, and due date.
- [ ] Re-test every fix, including regression and authorization tests for the original abuse case.
- [ ] Document accepted residual risk with an accountable owner and an expiry/review date.
- [ ] Record the reviewer, review date, commit or release identifier, and final sign-off decision.

## Review notes

Review date: ____________________

Reviewer(s): ____________________

Release / commit: ____________________

Decision: ____________________