test-security

name	test-security
description	Phase 7 security testing — check authentication/authorization, input handling, secrets, and known-vulnerability surface. Required when the task touches auth, secrets, sensitive data, or an external surface. Use when: a task touches auth/authz, handles secrets or sensitive/PII data, exposes an external attack surface, or the test-strategy selected security.

One-Liner

Verify the security surface on the strong tier — authn/authz, injection/XSS/SSRF, secret hygiene, vulnerable deps, data exposure — and never downgrade the check to save tokens.

Activation: required when the task involves auth, secrets, sensitive data, or an external attack surface (per check-test-strategy).

Check

• AuthN/AuthZ — every protected path enforces identity + permission; no missing checks; deny by default.
• Input handling — injection (SQL/command/template), XSS, SSRF, path traversal, unsafe deserialization.
• Secrets — none in code/logs/responses; correct storage; least privilege.
• Dependencies — scan for known-vulnerable packages; pin/patch.
• Data exposure — sensitive fields not over-returned; PII handled per policy.

Record

Record findings + their resolution in evidence ## Test and cross-link evidence ## Review; this is the security: verification. Use strong tier — never downgrade a security check to save tokens. Real exploitation testing stays within authorized scope only.

## Test
- security: PASS — authn/authz, input handling, secrets, deps, data-exposure checked
  findings: <none | id → resolution>   (cross-link ## Review)

Gate: every security finding is resolved or consciously accepted before harness verify.