# Production Security & Compliance Checklist

## 1. Authentication & Authorization Controls
- [x] **Bearer Token & API Key Authentication**: Verified (`app/core/security.py`).
- [x] **IDOR Session Ownership Validation**: Verified (`session.patient_id == auth.patient_id`).
- [x] **Unauthenticated Access Prevention**: Unauthenticated requests return `401 Unauthorized`.
- [x] **Unauthorized Session Modification Prevention**: Cross-patient requests return `403 Forbidden`.

## 2. Input Validation & Schema Boundaries
- [x] **Numeric Age Validation Bounds**: Enforced `ge=0, le=120` in `PatientContext` schema (`422` returned on invalid inputs).
- [x] **String & XSS Sanitization**: HTML tags stripped/escaped from initial greetings.
- [x] **File Upload Restrictions**: 10MB size limit and strict MIME validation (`JPEG`, `PNG`, `WEBP`, `PDF`).

## 3. Network & Transport Security
- [x] **CORS Configuration**: Wildcard origin (`*`) removed; explicit domain origins configured.
- [x] **HTTP Security Headers**: `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin-when-cross-origin` attached.
- [x] **Rate Limiting**: IP-based rate limiting enforced on API endpoints (`429 Too Many Requests` returned with `Retry-After`).

## 4. Operational & Container Security
- [x] **Non-Root Container**: Dockerfile configured with dedicated `appuser` (UID 999).
- [x] **Request ID Tracking**: Attached `X-Request-ID` correlation header to all HTTP requests.
- [x] **Error Masking**: Stack traces hidden behind generic `500 Internal Server Error` responses.