28 lines
1.1 KiB
JSON
28 lines
1.1 KiB
JSON
{
|
|
"feature_id": "F-009",
|
|
"stage": "security_gate",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"checked": [
|
|
"No new runtime or dev dependencies",
|
|
"Admin-only brand mutation routes use server-side shared auth and requireRole('admin')",
|
|
"Public brand reads expose only public SEO metadata",
|
|
"SQL queries use parameterized pg placeholders; dynamic UPDATE columns are whitelisted",
|
|
"Slug, UUID and payload validation use Zod via parseJson",
|
|
"Catalog brand filtering uses server-side stored brand relation",
|
|
"Catalog does not trust client brand data for product reads",
|
|
"Secret scan over F-009 files"
|
|
],
|
|
"findings": [],
|
|
"evidence": {
|
|
"npm_audit_runtime": "cd project && npm audit --audit-level=high --omit=dev — PASS: found 0 vulnerabilities",
|
|
"secret_scan": "grep over F-009 files found only non-secret test password fixtures",
|
|
"verify": "./scripts/verify.sh — PASS",
|
|
"tests": "cd project && npm test — PASS"
|
|
},
|
|
"notes": [
|
|
"No client-supplied role/user data is trusted.",
|
|
"Product brand assignment mutations are admin-only through product create/update routes."
|
|
]
|
|
}
|