📦 deps(thirdparty): update snapshots

2026-05-29 08:33:53 +00:00
parent fdb52f1e96
commit 06e0d13d57
1615 changed files with 232858 additions and 0 deletions
@@ -0,0 +1,124 @@
+# Security Review Checklist
+
+Complete checklist for security code review. Check each item before marking review complete.
+
+---
+
+## Authentication
+
+- [ ] Passwords hashed with bcrypt/argon2 (cost >= 12)
+- [ ] Session tokens cryptographically random (32+ bytes)
+- [ ] Session cookies: httpOnly, secure, sameSite=strict
+- [ ] Password reset tokens random + expiring (1 hour max)
+- [ ] Rate limiting on login (5 attempts / 15 min)
+- [ ] Account lockout after repeated failures
+- [ ] MFA available for sensitive accounts
+- [ ] JWT: signature verified, algorithm specified
+- [ ] JWT: short expiry, refresh token rotation
+- [ ] No credentials in URLs or logs
+
+## Authorization
+
+- [ ] All endpoints verify authentication server-side
+- [ ] Resource ownership verified before access (no IDOR)
+- [ ] Role checks on server, never client-only
+- [ ] Principle of least privilege applied
+- [ ] Admin functions require admin role server-side
+- [ ] API endpoints return 403 for unauthorized, not 404
+- [ ] Mass assignment prevented (explicit allowlists)
+- [ ] CORS configured with explicit origins (no wildcards with credentials)
+
+## Input Validation
+
+- [ ] All inputs validated (type, length, format)
+- [ ] SQL queries use parameterized statements
+- [ ] HTML output escaped or sanitized (no raw innerHTML)
+- [ ] File uploads validated (type, size, content)
+- [ ] File names sanitized (path.basename)
+- [ ] Path traversal prevented (prefix check after join)
+- [ ] Command injection prevented (execFile, no shell)
+- [ ] XML parsing disables external entities
+- [ ] JSON schema validation on API inputs
+
+## Cryptography
+
+- [ ] No hardcoded secrets in code
+- [ ] Secrets from environment variables
+- [ ] Strong algorithms only (AES-256-GCM, SHA-256+)
+- [ ] No MD5, SHA1, DES, ECB mode
+- [ ] crypto.randomBytes for all tokens
+- [ ] No Math.random for security purposes
+- [ ] HTTPS enforced (no HTTP endpoints)
+- [ ] TLS 1.2+ required
+- [ ] Certificate validation not disabled
+- [ ] Keys rotated periodically
+
+## Data Protection
+
+- [ ] Sensitive data encrypted at rest
+- [ ] TLS 1.2+ for data in transit
+- [ ] Sensitive data not logged (passwords, tokens, PII)
+- [ ] Error messages generic to users, detailed in logs
+- [ ] PII handling complies with regulations (GDPR, CCPA)
+- [ ] Database credentials not in code
+- [ ] Backups encrypted
+- [ ] Data retention policies implemented
+
+## Dependencies
+
+- [ ] All dependencies up to date
+- [ ] npm audit / cargo audit clean
+- [ ] No known CVEs in dependencies
+- [ ] Dependency scanning in CI/CD
+- [ ] Package lock files committed
+- [ ] Minimal dependency footprint
+- [ ] Source verification for dependencies
+- [ ] No unused dependencies
+
+## Logging & Monitoring
+
+- [ ] Authentication events logged (success + failure)
+- [ ] Authorization failures logged
+- [ ] Sensitive operations audited (admin actions, data access)
+- [ ] Log entries include timestamp, user ID, IP, action
+- [ ] Logs protected from tampering
+- [ ] No sensitive data in logs
+- [ ] Log injection prevented (sanitize user input in logs)
+- [ ] Security events trigger alerts
+- [ ] Incident response plan documented
+
+## Infrastructure
+
+- [ ] Security headers configured (helmet or equivalent)
+  - [ ] Content-Security-Policy
+  - [ ] X-Content-Type-Options: nosniff
+  - [ ] X-Frame-Options: DENY
+  - [ ] Strict-Transport-Security
+  - [ ] Referrer-Policy
+- [ ] Debug mode disabled in production
+- [ ] Default accounts/passwords changed
+- [ ] Unnecessary features/endpoints disabled
+- [ ] Error pages don't reveal stack traces
+- [ ] Rate limiting on all public endpoints
+
+## SSRF Prevention
+
+- [ ] URL inputs validated against allowlist
+- [ ] Private IPs blocked (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x)
+- [ ] Cloud metadata endpoints blocked (169.254.169.254)
+- [ ] Redirect following disabled or validated
+- [ ] DNS rebinding prevented
+
+---
+
+## Quick Pre-Commit Checklist
+
+Minimum checks before any commit touching security-sensitive code:
+
+1. [ ] No hardcoded secrets
+2. [ ] Inputs validated
+3. [ ] SQL parameterized
+4. [ ] Auth checked server-side
+5. [ ] Ownership verified for resources
+6. [ ] Sensitive data not logged
+7. [ ] npm audit clean