| summary | read_when | ||
|---|---|---|---|
Security baseline for frontend/backend workflow changes. |
|
- validate all untrusted input at the boundary
- keep secrets out of the frontend
- log safely; do not leak secrets or raw credentials
- prefer least-privilege connectors
- treat auth and authorization as explicit requirements, not assumptions
Do an explicit security pass when the change touches:
- authentication
- authorization
- user-generated content
- file upload or download
- external webhooks or callbacks
- tokens, API keys, or cookies
If a task changes a security-relevant behavior, the relevant doc and ExecPlan must say what changed and how it was verified.