@schneiderjoseph/devia 0.1.0

package/standard/engineering/security/API_SECURITY.md

@@ -0,0 +1,22 @@
+# API security
+
+## P0
+
+1. Authenticate and authorize every sensitive endpoint
+2. Validate request schemas before business logic
+3. Rate-limit public and auth endpoints
+4. Verify webhook signatures before trusting events
+5. Never put provider secrets in browser calls
+
+## P1
+
+1. Security headers (CSP start report-only, then enforce; plus baseline headers)
+2. CORS allowlists — not `*` with credentials
+3. Idempotency keys on payment and other critical POSTs
+4. Consistent error shape without internal details
+
+## Detect
+
+- Open CORS on credentialed APIs
+- Webhook handlers that accept raw JSON with no signature
+- GraphQL/Data APIs that expose fields based only on “knowing the UUID”

package/standard/engineering/security/ASVS_5.0/V10_MALICIOUS_CODE.md

@@ -0,0 +1,31 @@
+# ASVS — V10 MALICIOUS CODE
+
+**OWASP ASVS theme:** Malicious Code
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Dependency review; no obfuscated implants; install-script risk
+
+## Our primary docs
+
+- `docs/security/SECURITY.md`
+
+## Traceability
+
+```text
+ASVS theme (V10_MALICIOUS_CODE)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V11_BUSINESS_LOGIC.md

@@ -0,0 +1,31 @@
+# ASVS — V11 BUSINESS LOGIC
+
+**OWASP ASVS theme:** Business Logic
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Abuse cases; idempotency; race/workflow integrity
+
+## Our primary docs
+
+- `docs/backend/API.md`
+
+## Traceability
+
+```text
+ASVS theme (V11_BUSINESS_LOGIC)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V12_FILES.md

@@ -0,0 +1,31 @@
+# ASVS — V12 FILES
+
+**OWASP ASVS theme:** File Handling
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Upload type/size limits; storage isolation; malware scanning when needed
+
+## Our primary docs
+
+- `docs/security/API_SECURITY.md`
+
+## Traceability
+
+```text
+ASVS theme (V12_FILES)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V13_API.md

@@ -0,0 +1,31 @@
+# ASVS — V13 API
+
+**OWASP ASVS theme:** API and Web Service
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Authn on APIs; mass assignment; rate limits
+
+## Our primary docs
+
+- `docs/backend/API.md`
+
+## Traceability
+
+```text
+ASVS theme (V13_API)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V14_CONFIGURATION.md

@@ -0,0 +1,31 @@
+# ASVS — V14 CONFIGURATION
+
+**OWASP ASVS theme:** Configuration
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Hardened defaults; secrets management; env separation
+
+## Our primary docs
+
+- `docs/security/SECRETS.md`
+
+## Traceability
+
+```text
+ASVS theme (V14_CONFIGURATION)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V1_ARCHITECTURE.md

@@ -0,0 +1,31 @@
+# ASVS — V1 ARCHITECTURE
+
+**OWASP ASVS theme:** Architecture, Design and Threat Modeling
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Architecture decision records; threat model for sensitive apps
+
+## Our primary docs
+
+- `docs/architecture/`
+
+## Traceability
+
+```text
+ASVS theme (V1_ARCHITECTURE)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V2_AUTHENTICATION.md

@@ -0,0 +1,31 @@
+# ASVS — V2 AUTHENTICATION
+
+**OWASP ASVS theme:** Authentication
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Login, MFA, credential storage, account recovery
+
+## Our primary docs
+
+- `docs/security/AUTHENTICATION.md`
+
+## Traceability
+
+```text
+ASVS theme (V2_AUTHENTICATION)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V3_SESSION.md

@@ -0,0 +1,31 @@
+# ASVS — V3 SESSION
+
+**OWASP ASVS theme:** Session Management
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Session fixation, timeout, cookie flags, refresh rotation
+
+## Our primary docs
+
+- `docs/security/AUTHENTICATION.md`
+
+## Traceability
+
+```text
+ASVS theme (V3_SESSION)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V4_ACCESS_CONTROL.md

@@ -0,0 +1,31 @@
+# ASVS — V4 ACCESS CONTROL
+
+**OWASP ASVS theme:** Access Control
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Server-side authz; tenant isolation; deny by default
+
+## Our primary docs
+
+- `docs/security/AUTHORIZATION.md`
+
+## Traceability
+
+```text
+ASVS theme (V4_ACCESS_CONTROL)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V5_VALIDATION.md

@@ -0,0 +1,31 @@
+# ASVS — V5 VALIDATION
+
+**OWASP ASVS theme:** Validation, Sanitization and Encoding
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Schema validation; output encoding; injection resistance
+
+## Our primary docs
+
+- `docs/security/API_SECURITY.md`
+
+## Traceability
+
+```text
+ASVS theme (V5_VALIDATION)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V6_CRYPTOGRAPHY.md

@@ -0,0 +1,31 @@
+# ASVS — V6 CRYPTOGRAPHY
+
+**OWASP ASVS theme:** Stored Cryptography
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Approved algorithms; key management; no home-rolled crypto
+
+## Our primary docs
+
+- `docs/security/DATA_SECURITY.md`
+
+## Traceability
+
+```text
+ASVS theme (V6_CRYPTOGRAPHY)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V7_ERROR_HANDLING.md

@@ -0,0 +1,31 @@
+# ASVS — V7 ERROR HANDLING
+
+**OWASP ASVS theme:** Error Handling and Logging
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Safe client errors; structured logs; no secret leakage
+
+## Our primary docs
+
+- `docs/backend/ERROR_HANDLING.md`
+
+## Traceability
+
+```text
+ASVS theme (V7_ERROR_HANDLING)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V8_DATA_PROTECTION.md

@@ -0,0 +1,31 @@
+# ASVS — V8 DATA PROTECTION
+
+**OWASP ASVS theme:** Data Protection
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+Classification; encryption; minimization
+
+## Our primary docs
+
+- `docs/security/DATA_SECURITY.md`
+
+## Traceability
+
+```text
+ASVS theme (V8_DATA_PROTECTION)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_5.0/V9_COMMUNICATION.md

@@ -0,0 +1,31 @@
+# ASVS — V9 COMMUNICATION
+
+**OWASP ASVS theme:** Communication
+
+> This file maps ASVS intent into **this standard**. It is not a verbatim copy of OWASP ASVS.
+> Always prefer the official [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) text for audits.
+
+## Focus in this standard
+
+TLS; secure headers; certificate hygiene
+
+## Our primary docs
+
+- `docs/security/API_SECURITY.md`
+
+## Traceability
+
+```text
+ASVS theme (V9_COMMUNICATION)
+    → Our rules (linked docs)
+    → Checklist items (checklists/security.md + domain checklists)
+    → Automated checks (scripts/production-check.mjs + app tests)
+    → CI gates (templates/github/workflows/app-ci.yml)
+```
+
+See [`../ASVS_REGISTRY.md`](../ASVS_REGISTRY.md) for concrete rows.
+
+## Agent rules
+
+- Do not claim ASVS compliance without evidence against the official requirements.
+- When implementing features in this theme, update checklist evidence and tests, not just docs.

package/standard/engineering/security/ASVS_REGISTRY.md

@@ -0,0 +1,31 @@
+# ASVS registry — requirement → rule → check → CI
+
+Traceability spine for security controls. Expand rows as apps adopt the standard.
+
+Legend: **Auto** = scriptable today in `production-check` / typical Node CI · **Test** = app must provide automated test · **Manual** = human sign-off until automated.
+
+| ASVS theme | Our rule (P0/P1) | Checklist | Automated check | CI gate |
+|---|---|---|---|---|
+| V2 Authentication | P0 server verifies identity on protected routes | `checklists/security.md` | Test: unauthenticated → 401 | unit/integration job |
+| V3 Session | P0 secure cookie / token handling; no session fixation | `checklists/security.md` | Test + config review | security job |
+| V4 Access control | P0 authz on every sensitive read/write; tenant scope from server session | `checklists/security.md` | Test: user A cannot read B | unit/integration **required** |
+| V5 Validation | P0 validate external input before business logic | `checklists/api.md` | schema tests / fuzz critical parsers | unit + lint |
+| V6 Cryptography | P0 no plaintext secrets at rest where threat model requires crypto; no home-rolled | `checklists/security.md` | Manual + dep review | secret scan + review |
+| V7 Error handling | P0 no stack/SQL internals to clients in prod | `checklists/api.md` | Test prod error shape | unit/integration |
+| V8 Data protection | P1 classify sensitive fields; minimize retention | `checklists/production.md` | Manual / compliance review | release checklist |
+| V9 Communication | P0 HTTPS in production | `checklists/devops.md` | deploy config / smoke | deploy gates |
+| V10 Malicious code | P1 lockfile + dependency audit | `checklists/devops.md` | `npm audit` / OSV | **dependency-audit** required |
+| V11 Business logic | P1 abuse cases for money/state transitions | domain tests | Test | integration/E2E |
+| V12 Files | P0 constrain uploads if feature exists | `checklists/security.md` | Test size/type | integration |
+| V13 API | P0 rate limit auth & public abuse surfaces | `checklists/api.md` | Test or config evidence | security job |
+| V14 Configuration | P0 no secrets in git; env separation | `checklists/security.md` | secret scan + `.env` gitignore | **secret-scan** required |
+| V1 Architecture | P1 threat model for sensitive apps; ADRs for irreversible choices | `checklists/architecture.md` | Manual / ADR presence | review |
+
+## How to extend
+
+When you add a P0 security rule:
+
+1. Link the ASVS theme chapter under `ASVS_5.0/`
+2. Add a checklist checkbox
+3. Add a `production-check` evidence probe **or** name the required test id
+4. Mark the CI job that fails the PR if missing

package/standard/engineering/security/AUTHENTICATION.md

@@ -0,0 +1,28 @@
+# Authentication
+
+## P0
+
+1. Use a proven password hashing algorithm (e.g. Argon2id / bcrypt) — never plaintext or reversible encryption for passwords.
+2. Protect login/password-reset against brute force (rate limits, lockout/backoff).
+3. Sessions/tokens expire; logout revokes server-side session or refresh token where applicable.
+4. Prefer established auth providers/libraries over home-grown crypto.
+5. Reject unexpected JWT algorithms explicitly (disallow `none`).
+
+## P1
+
+1. Email verification for self-serve signup when identity matters
+2. MFA for admin / high-privilege accounts
+3. Secure account recovery flows (no user enumeration where feasible)
+4. Refresh-token rotation and silent refresh patterns that preserve UX without eternal sessions
+
+## Detect
+
+- Passwords stored with MD5/SHA1
+- Tokens in `localStorage` without a clear XSS threat strategy
+- Infinite session lifetime
+
+## Verify
+
+- Parallel login stress does not collide sessions
+- Expired tokens are rejected
+- Password reset tokens are single-use and time-limited

package/standard/engineering/security/AUTHORIZATION.md

@@ -0,0 +1,27 @@
+# Authorization
+
+**Authentication ≠ authorization.** Login answers *who*. Every route must still answer *what they can do*.
+
+## P0
+
+1. Enforce permissions on the server (API/DB). Hiding a button is not access control.
+2. Object-level authorization on every resource (prevent IDOR/BOLA).
+3. For multi-tenant apps, scope every query by tenant from the **verified** server session — never trust client-sent `tenantId` alone.
+4. Add automated tests that User A cannot read/write User B (and Tenant A ↛ Tenant B).
+
+## P1
+
+1. Model RBAC as permissions first; roles are bundles of permissions
+2. Admin/support break-glass access is audited and explicit
+3. Deny by default on new endpoints
+
+## Detect
+
+- `GET /items/:id` with no ownership check
+- Authorization only in React route guards
+- Shared “service role” keys in the browser
+
+## Verify
+
+- Cross-user and cross-tenant denial tests in CI
+- Mutating endpoints return 401/403 correctly

package/standard/engineering/security/DATA_SECURITY.md

@@ -0,0 +1,14 @@
+# Data security
+
+## P0
+
+1. Classify data (public, internal, PII, secrets, payment)
+2. Encrypt in transit (TLS)
+3. Minimize PII in logs
+4. Access to production data is least-privilege and audited
+
+## P1
+
+1. Encrypt sensitive fields at rest when threat model requires
+2. Retention and deletion processes exist (see `docs/compliance/`)
+3. Exports and backups are protected equivalently to production data

package/standard/engineering/security/OWASP_ASVS.md

@@ -0,0 +1,31 @@
+# OWASP ASVS
+
+Use [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) as the detailed security requirements catalog.
+
+## In this repo
+
+| Path | Role |
+|---|---|
+| [`ASVS_5.0/`](ASVS_5.0/) | Theme chapters (V1–V14) mapped to our docs |
+| [`ASVS_REGISTRY.md`](ASVS_REGISTRY.md) | Requirement → rule → checklist → test → CI |
+
+## How to use
+
+1. Choose a target verification level appropriate to risk (many SaaS start with a pragmatic Level 1–2 subset).
+2. Track coverage via the registry + `checklists/security.md`.
+3. Prefer official ASVS wording in formal audits; use this repo for engineering application.
+4. Never claim “ASVS certified” without performing verification against the official standard.
+
+## Traceability model
+
+```text
+ASVS Requirement
+       ↓
+Our Rule (docs/security/*)
+       ↓
+Checklist (checklists/security.md)
+       ↓
+Automated Test / production-check probe
+       ↓
+CI Gate (required check)
+```

package/standard/engineering/security/SECRETS.md

@@ -0,0 +1,28 @@
+# Secrets
+
+## P0
+
+1. No secrets in source control, screenshots, logs, or client bundles
+2. `.env` is gitignored; provide `.env.example` with empty placeholders
+3. Separate credentials per environment (local / staging / prod)
+4. If a secret was ever committed: **rotate it** — deleting the line is not enough
+
+## P1
+
+1. Use a secret manager in real deployments
+2. Short-lived credentials where the platform allows
+3. Secret scanning in CI (and push protection when available)
+
+## Forbidden examples
+
+```text
+password = "admin123"
+API_KEY = "sk-..."
+DATABASE_PASSWORD = "..."
+```
+
+## Required pattern
+
+```text
+env / secret manager → server runtime only → never NEXT_PUBLIC_* for private keys
+```

package/standard/engineering/security/SECURITY.md

@@ -0,0 +1,28 @@
+# Security overview
+
+Security is not a final polish step. Defaults from scaffolds and AI codegen are often demo-oriented and **open**.
+
+## Baseline domains (ASVS-oriented)
+
+- Authentication
+- Authorization / access control
+- Session management
+- Input validation & output encoding
+- Cryptography
+- Error handling & logging
+- Data protection
+- API security
+- File handling
+- Business logic security
+- Configuration security
+
+## P0 ship blockers
+
+1. No secrets in git or client bundles; rotate anything that ever leaked
+2. Server-side authorization on every sensitive read/write (UI checks are not security)
+3. Validate/sanitize all external input before business logic
+4. Hide stack traces and internal errors from clients in production
+5. Rate-limit auth and other public abuse surfaces
+6. HTTPS in production with secure cookie attributes where cookies are used
+
+See also: `AUTHENTICATION.md`, `AUTHORIZATION.md`, `SECRETS.md`, `API_SECURITY.md`, and [`checklists/security.md`](../../../checklists/engineering/security.md).