testing-security

<input_requirements> Authorization model and roles List of critical endpoints/functions Data classification and risk areas Allowed check set and environment Access to logs/monitoring and request-id </input_requirements>

<execution_rules> Verify authn/authz for each role and forbidden path Verify session management (expiration, logout, refresh) Verify input validation (XSS/SQLi) without destroying data Verify CSRF for state-changing operations (if applicable) Verify rate limiting and abuse blocking Check data leaks in responses, logs, and errors </execution_rules>