audit-pre-production

name	Audit Pre-Production
description	Full pre-production readiness audit combining all domain audits. Use when asked to assess production readiness, do a launch checklist, or perform a go/no-go review. Covers OWASP Top 10, GDPR, GPSR, multi-tenancy, and operational readiness.

Audit Pre-Production

Master audit that orchestrates all domain audits and produces a go/no-go decision.

Prerequisites

• Run (or have results from) all 6 domain audits:
  • audit-frontend, audit-admin, audit-database, audit-api, audit-podclaw, audit-infrastructure
• Read existing audit reports at workspace root (AUDIT_*_[DATE].md)
• Read CLAUDE.md for architecture overview

Workflow

Phase 1: Aggregate Domain Audits

1. Collect existing reports:

   • Read all AUDIT_*_[DATE].md files
   • Extract CRITICAL and FAIL items from each
   • Build consolidated issue list

2. Run missing audits:

   • If any domain audit is missing or stale (>7 days), trigger it
   • Use the corresponding audit skill

Phase 2: OWASP Top 10 Cross-Check

3. A01 Broken Access Control:

   • RLS policies enforced? (from DB audit)
   • Auth on every endpoint? (from API audit)
   • Admin RBAC working? (from admin audit)

4. A02 Cryptographic Failures:

   • Secrets in env vars, not code? (from infra audit)
   • HTTPS enforced? (from infra audit)
   • Password hashing algorithm? (from admin audit)

5. A03 Injection:

   • SQL injection vectors? (from API audit)
   • XSS vectors? (from frontend audit)
   • Command injection? (from API/PodClaw audit)

6. A04 Insecure Design:

   • Multi-tenancy isolation verified? (from DB audit)
   • Chat isolation per user? (from frontend audit)
   • Agent sandboxing? (from PodClaw audit)

7. A05 Security Misconfiguration:

   • Security headers present? (from frontend/admin/infra audit)
   • Default credentials removed? (from admin audit)
   • Debug mode disabled? (from all audits)

8. A06 Vulnerable Components:

   • npm audit results for frontend and admin
   • Python dependency audit for PodClaw
   • Docker image CVE scan

9. A07 Authentication Failures:

   • Brute force protection? (from admin audit)
   • Session management? (from frontend/admin audit)
   • MFA available? (from admin audit)

10. A08 Data Integrity Failures:

    • Webhook signature validation? (from API audit)
    • CI/CD pipeline security? (from infra audit)
    • Dependency integrity? (lockfile pinning)

11. A09 Logging & Monitoring:

    • Audit logging? (from admin audit)
    • Agent activity logging? (from PodClaw audit)
    • Infrastructure monitoring? (from infra audit)

12. A10 SSRF:

    • Can users trigger server-side requests? (AI calls, image URLs)
    • Are URLs validated before fetching?
    • Is there an allowlist for external domains?

Phase 3: Regulatory Compliance

13. GDPR compliance:

    • Is there a privacy policy?
    • Can users export their data?
    • Can users delete their account and all data?
    • Is consent tracked for marketing communications?
    • Are data processing records maintained?

14. GPSR compliance (EU Product Safety):

    • Do ALL products have safety_information in product_details?
    • Is manufacturer info present?
    • Are material compositions listed?
    • Is care instruction info available?

15. Cookie consent:

    • Is there a cookie banner?
    • Are non-essential cookies blocked until consent?
    • Is consent revocable?

Phase 4: Operational Readiness

16. Deployment checklist:

    • Can the system be deployed from scratch with start.sh?
    • Is there a rollback procedure?
    • Are backups configured and tested?
    • Is there a runbook for common failures?

17. Monitoring & alerting:

    • Are health checks configured for all services?
    • Is there uptime monitoring?
    • Are error alerts configured? (email, Telegram, etc.)
    • Is there a status page?

18. Performance baseline:

    • Are page load times acceptable? (<3s on 3G)
    • Are API response times reasonable? (<500ms p95)
    • Is there a CDN for static assets?
    • Are images optimized?

Phase 5: Go/No-Go Decision

19. Classify all findings:

    • BLOCKER: Must fix before launch (any CRITICAL from domain audits)
    • SHOULD FIX: Fix within first week post-launch
    • NICE TO HAVE: Backlog items

20. Decision matrix:

    • 0 BLOCKERS → GO
    • 1+ BLOCKERS → NO-GO (list required fixes)

Output Format

Generate AUDIT_PREPRODUCTION_[DATE].md at workspace root with:

# Pre-Production Audit — [DATE]

## GO / NO-GO Decision: [GO | NO-GO]

## Blockers (must fix before launch)
[List with source audit and fix description]

## OWASP Top 10 Matrix
| Category | Status | Source | Notes |
|---|---|---|---|

## GDPR Compliance
| Requirement | Status | Notes |
|---|---|---|

## GPSR Compliance
| Requirement | Status | Notes |
|---|---|---|

## Should Fix (first week)
[Prioritized list]

## Nice to Have (backlog)
[Deprioritized list]

## Domain Audit Summary
| Audit | Date | CRITICAL | FAIL | WARN | PASS |
|---|---|---|---|---|---|