aionboarding/ai-patient-onboarding/production_security_checklist.md

Production Security & Compliance Checklist

1. Authentication & Authorization Controls

• Bearer Token & API Key Authentication: Verified (app/core/security.py).
• IDOR Session Ownership Validation: Verified (session.patient_id == auth.patient_id).
• Unauthenticated Access Prevention: Unauthenticated requests return 401 Unauthorized.
• Unauthorized Session Modification Prevention: Cross-patient requests return 403 Forbidden.

2. Input Validation & Schema Boundaries

• Numeric Age Validation Bounds: Enforced ge=0, le=120 in PatientContext schema (422 returned on invalid inputs).
• String & XSS Sanitization: HTML tags stripped/escaped from initial greetings.
• File Upload Restrictions: 10MB size limit and strict MIME validation (JPEG, PNG, WEBP, PDF).

3. Network & Transport Security

• CORS Configuration: Wildcard origin (*) removed; explicit domain origins configured.
• HTTP Security Headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin attached.
• Rate Limiting: IP-based rate limiting enforced on API endpoints (429 Too Many Requests returned with Retry-After).

4. Operational & Container Security

• Non-Root Container: Dockerfile configured with dedicated appuser (UID 999).
• Request ID Tracking: Attached X-Request-ID correlation header to all HTTP requests.
• Error Masking: Stack traces hidden behind generic 500 Internal Server Error responses.