security_audit（安全审计）

Security Audit Protocol

1. Critical "Guard" Files

WARNING: The following files are OFF-LIMITS for modification without explicit user approval.

• scripts/ai-diff-gate.ts
• .github/workflows/**
• Any file with midlaw or policy in the name.

2. Database Security (Supabase)

• RLS (Row Level Security):

- EVERY table must have RLS enabled. - Policies must explicitly define USING and WITH CHECK clauses. - NEVER use service_role key in frontend client code.

• SQL Injection:

- Use parameterized queries or ORM methods (Supabase JS client) only. - Avoid raw SQL string concatenation.

3. API Security

• Authentication:

- Verify user exists in req (usually populated by middleware/auth helper). - Check permissions before performing actions (e.g. checkPermission(user.id, 'post.create')).

• Input Validation:

- Validate ALL inputs using zod schemas. - Sanitize HTML inputs if rendering user content (use DOMPurify).

4. Audit Checklist

• Are guards/policies untouched?
• Is RLS enabled and tested?
• Is input validation (zod) in place?
• Are no secrets committed to code?
• Did I run /security-review (if available) or manual check?