29 lines
1.2 KiB
JSON
29 lines
1.2 KiB
JSON
{
|
|
"feature_id": "F-008",
|
|
"stage": "security_gate",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"checked": [
|
|
"No new runtime or dev dependencies",
|
|
"Admin-only product mutation routes use server-side shared auth and requireRole('admin')",
|
|
"Public product reads expose only active products",
|
|
"SQL queries use parameterized pg placeholders; dynamic UPDATE columns are whitelisted",
|
|
"Slug, UUID, state and payload validation use Zod via parseJson",
|
|
"Category assignment is validated server-side before write",
|
|
"Domain layer does not import DB or HTTP APIs",
|
|
"Secret scan over F-008 files"
|
|
],
|
|
"findings": [],
|
|
"evidence": {
|
|
"npm_audit_runtime": "cd project && npm audit --audit-level=high --omit=dev — PASS: found 0 vulnerabilities",
|
|
"secret_scan": "grep over F-008 files found only a non-secret test password fixture",
|
|
"domain_scan": "No pg/fastify/http imports in catalog domain",
|
|
"verify": "./scripts/verify.sh — PASS",
|
|
"tests": "cd project && npm test — PASS"
|
|
},
|
|
"notes": [
|
|
"No client-supplied role/user data is trusted.",
|
|
"Public reads are active-only so draft/archived products are not exposed via catalog endpoints."
|
|
]
|
|
}
|