27 lines
1.0 KiB
JSON
27 lines
1.0 KiB
JSON
{
|
|
"feature_id": "F-007",
|
|
"stage": "security_gate",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"checked": [
|
|
"No new runtime or dev dependencies",
|
|
"Admin-only category mutation routes use server-side shared auth and requireRole('admin')",
|
|
"Public category reads expose slugs, not privileged data",
|
|
"SQL queries use parameterized pg placeholders; dynamic UPDATE columns are whitelisted",
|
|
"Slug, UUID and payload validation use Zod via parseJson",
|
|
"Recursive cycle detection uses parameterized CTE",
|
|
"Secret scan over F-007 files"
|
|
],
|
|
"findings": [],
|
|
"evidence": {
|
|
"npm_audit_runtime": "cd project && npm audit --audit-level=high --omit=dev — PASS: found 0 vulnerabilities",
|
|
"secret_scan": "grep over F-007 files found only a non-secret test password fixture",
|
|
"verify": "./scripts/verify.sh — PASS",
|
|
"tests": "cd project && npm test — PASS"
|
|
},
|
|
"notes": [
|
|
"No client-supplied role/user data is trusted.",
|
|
"Category deletion protects non-leaf categories with 409."
|
|
]
|
|
}
|