---
name: Security Deliverable Checklist
description: Hit every literal requirement a security review/grade checks for.
---
# Security Deliverable Checklist

Security deliverables (threat models, reviews, architectures) are graded on identifying the specific threats AND prescribing specific mitigations. Run this checklist before submitting.

## Universal checks
- **Named addressee** if the brief implies one.
- **Word count** inside any band.
- **Labeled sections** — one per threat, with the threat named.

## Threat model specific
For EACH attack surface in the brief, name the threat class and the mitigation:
- **SSRF** (server fetches user URL) → IP allowlist/blocklist of internal ranges (169.254/16, 10/8, 172.16/12, 192.168/16, 127/8, ::1), scheme restriction (http/https only), redirect-following limits.
- **Malicious-content proxying** → content-type validation, sanitization, size limits, scanning.
- **Injection** (SQL/command/path) → parameterization, never string concatenation.
- **Authn/Authz** → authenticate then authorize per action; IDOR checks; least privilege.
- **Input validation** → at the boundary, allowlist over blocklist, canonicalize.
- **Rate limiting / abuse** → per-IP and per-user limits, backoff, CAPTCHA for repeated failures.
- **Secrets** → never logged, never in URLs, rotated, least-privilege scope.
- **Logging/monitoring** → security events logged, anomaly detection.

## For each threat
State: the threat NAME, WHY it applies here (the specific feature), and the CONCRETE mitigation (not "validate input" but "allowlist URL scheme to http/https + block internal IP ranges").

## Final pass
Re-read the brief; for each feature/surface described, ensure the applicable threat + mitigation is present. Generic "follow security best practices" earns no points — name the threat, name the fix.