Security & Compliance

Build real security, not checkbox security.

Quick Start

1. Scope the system and data:
   • What data types exist (PII/PHI/payment/secrets)? Where is it stored and transmitted?
   • Trust boundaries (browser ↔ edge ↔ API ↔ DB ↔ 3rd parties)
2. Threat model (lightweight): list top 5 abuse cases + mitigations.
3. Controls: pick practical controls (authN/authZ, encryption, logging, rate limits, backups, key mgmt).
4. Evidence: document decisions and “how we know it works” (configs, screenshots, logs, tests).

Output artifacts (default)

• 5-item threat model table (abuse case → impact → mitigation).
• Control checklist mapped to the system’s trust boundaries.
• Evidence list: concrete proofs (configs, logs, tests) with where to find them.