Skip to main content

SECURITY_AREAS

@forge/monorepo

@forge/monorepo / backend/src / SECURITY_AREAS

Variable: SECURITY_AREAS

const SECURITY_AREAS: readonly ["credentials", "egress", "isolation", "prompt-injection"]

Defined in: backend/src/security/checklist.ts:15

The security review as a repeatable checklist — REQ-033 (#145), AC-6.

Data, not prose, for the reason every list in this codebase is data: a checklist in a document is one that drifts from the code silently, and the drift is found by whoever needed the check it lost.

Each entry names the property, the acceptance criterion it serves, and how it is verified — a test id, a build gate, or "by reading, at each release". That last kind is the honest one: some properties cannot be asserted by a machine, and pretending otherwise produces a green tick where a person should have looked.

verifiedBy: "manual" entries are what make this a checklist rather than a test suite. They are the reason #145 asks for it to be re-run at each release instead of treated as done.