# Security Baseline (Phase 0-2)

Purpose: shift minimum security controls left so they are not deferred to final hardening.

---

## Mandatory by End of Phase 0

1. Secrets from environment variables only for non-dev environments.
2. No plaintext secrets in repository, configs, examples, or test fixtures.
3. Secret scanning enabled in CI.
4. Dependency vulnerability scan enabled in CI.
5. Standard secure headers baseline documented for gateway_api and gateway_web.

---

## Mandatory by End of Phase 1

1. Authentication enforced on all business endpoints.
2. Health endpoints limited to /health/live and /health/ready only.
3. Auth failure and success audit events logged with trace_id.
4. Rate limiting enabled on auth-sensitive endpoints.
5. JWT validation includes exp, iat, and tenant claims.
6. API keys stored as Argon2 hashes only.

---

## Mandatory by End of Phase 2

1. Data sanitization enforced for audit and DLQ snapshots.
2. Adapter timeout and circuit breaker defaults documented and implemented.
3. PII field classification matrix approved by Compliance.
4. TLS required for all outbound adapter connections in non-dev environments.
5. File ingestion validates schema before persistence to downstream systems.

---

## Logging and Tracing Rules

1. trace_id must be present in all request and async logs.
2. Never log secrets, tokens, passwords, card numbers, cvv, or full account numbers.
3. Span attributes must not contain cardholder data.

---

## Security Review Checklist for Kickoff

- [ ] Secret scanning active in CI
- [ ] Dependency CVE scanning active in CI
- [ ] Endpoint auth matrix documented
- [ ] Redaction rules documented and tested
- [ ] Incident escalation contacts assigned

---

## Ownership

- Security Team: control definition and sign-off.
- Platform Team: CI policy and runtime enforcement.
- Engineering Teams: implementation and evidence generation.