security-audit-checklistlisted

# Security Audit Checklist Run these checks on any system before shipping to production or after major changes. ## Before you start The checklist itself is prose and needs nothing. The three scanners under `scripts/` are Python, so running those needs **Python 3** on your machine (`python3 --version`). Without it you can still work the checklist by hand; you just do not get the automated secret scan, header check and IaC read. ## 1. Privacy & Data Governance - [ ] **Privacy policy exists** if the app collects, stores, or processes any user data. Link it in the footer and signup flows. - [ ] **Know where user data is stored**: document the primary database, caches, logs, backups, and third-party services. Check data residency requirements (GDPR, CCPA). - [ ] **Data minimization**: only collect what you need. Delete or anonymize data you do not use. ## 2. Secret & Key Hygiene - [ ] **.env values are not leaking**: scan the full repo for hardcoded secrets. - [ ] **Never expose API keys in frontend code**: no keys in JS bundles, no sensitive values in public env prefixes (`REACT_APP_`, `NEXT_PUBLIC_`, `VITE_`). - [ ] **Move keys server-side or behind a proxy**: all third-party API calls that require secrets must go through a backend endpoint. - [ ] **Remove secrets from logs**: grep logs and error reporters for keys, tokens, and passwords. Mask or redact them before output. - [ ] **Rotate leaked credentials immediately** if anything is found. **Quick scan commands:** ```