Skip to content

Security Checklist

Lightweight, repeatable security & privacy review pass aligned with the Security Privacy Baseline v1 controls SPB-01 through SPB-15.

When to use

  • Pre-commit on changes touching: credentials, secrets, network egress, file IO, deserialization, eval-likes, auth, user data.
  • New dependency added.
  • New environment variable or config knob introduced.
  • Before promoting a project from Stage 0 → Stage 1.

What you produce

A pass / partial / fail assessment per relevant SPB control, with concrete remediation suggestions.

Procedure

  1. Identify the change surface. Files modified, new deps, new env vars, network endpoints, secret usage.
  2. For each relevant control, evaluate:
  3. SPB-01 Data classification: is the data class declared and respected?
  4. SPB-02 Agent credential isolation: any shared credentials? agent-scoped?
  5. SPB-03 User-only secret store: any path the agent could read user secrets?
  6. SPB-04 Least-privilege: scopes minimal? deny-by-default?
  7. SPB-05 TTL: any long-lived tokens introduced?
  8. SPB-06 JIT: privileged op without explicit approval/expiry?
  9. SPB-07 Provisioning: new credential added without request/approval record?
  10. SPB-08 Rotation: rotation plan exists?
  11. SPB-09 Secret handling: plaintext in repo / log / prompt / artifact?
  12. SPB-10 Runtime boundary: data class compatible with runtime?
  13. SPB-11 Egress: outbound network minimized? allowlist updated?
  14. SPB-12 Audit: privileged actions emit audit events?
  15. SPB-13 Attestation: project still passes baseline attestation?
  16. SPB-14 Incident response: secret-compromise playbook still valid?
  17. SPB-15 Policy change: any baseline change documented?
  18. Score each evaluated control as pass, partial, fail, or n/a.
  19. Recommend smallest-fix remediation for each non-pass.
  20. Decide: safe to commit, return to bounded edit, or escalate.

Report template

# Security Checklist — <change>

## Surface
- Files: ...
- New deps: ...
- New env / config: ...
- Network endpoints: ...

## Evaluations

| Control | Result | Notes / remediation |
| ------- | ------ | ------------------- |
| SPB-01  |        |                     |
| ...     |        |                     |

## Decision
- [ ] safe to commit
- [ ] return to bounded edit (list fixes)
- [ ] escalate (reason)

Compatibility

  • Runs read-only against the diff.
  • Does not exfiltrate code or findings outside the workspace.
  • If MCP servers are used during the review, they must be in the project allowlist.