Hardening - security review

External security review

Review the external security review scope, evidence package, remediation lanes, sample findings, signoff gates, and disabled pilot-launch actions.

Otto Fixture BPPE Career School - security review hardening

School Administrator · Sam Director

Checklist and remediation tracker

Ticket 157 prepares the SEC-R-002 external review package for authentication, tenancy, RLS, OWASP controls, payments, AI, audit logging, incident response, and remediation tracking. It does not mark the external review complete, resolve high-severity findings, publish a penetration-test report, claim SOC 2, or approve pilot launch.

Reviewed 2026-10-13

Scope items

Security areas prepared for external reviewer scope.

Package items

Artifacts and routes included in the reviewer package.

Findings

Sample findings tracked by severity, owner, and due target.

High open

High or critical findings that stay open in this local proof.

Ready

Production security readiness stays false until external signoff.

Review scope

Authentication, tenancy, RLS, OWASP, payments, AI, and incident controls

8 scope items

Authentication, MFA, and step-up

Documented

SEC-R-002SEC-R-011

Question: Can staff, instructors, and high-risk actions be protected with MFA, session limits, and step-up controls?
Evidence: Auth status, security proof, MFA policy, and role shell pages are local review artifacts.
Owner: Engineering and external reviewer

Tenant isolation and RLS

External review

SEC-R-002SEC-R-030

Question: Can one tenant read, export, search, or infer another tenant's records?
Evidence: withTenant, RLS audit, pgTAP suite, seeded two-school checks, and critical scenarios are the review inputs.
Owner: Engineering and external reviewer

Secrets, TLS, and encryption

Documented

SEC-R-010SEC-R-014

Question: Are secrets kept out of source, TLS and storage expectations documented, and high-sensitivity data protected?
Evidence: Secret scan, preview/staging environment docs, and placeholder env examples are the local proof.
Owner: Security and engineering

OWASP controls

External review

SEC-R-012

Question: Are output encoding, CSRF posture, parameterized access, CSP, upload validation, and SSRF protections covered?
Evidence: File upload security, public page hardening, route tests, and proof boundaries are ready for review.
Owner: Engineering and external reviewer

Files, signed URLs, and malware gates

External review

SEC-R-012SEC-R-013

Question: Are file URLs short-lived, signed, tenant-scoped, single-purpose, and malware gated before production?
Evidence: File upload security proof covers signed URL expiry, tenant-prefixed keys, and sanitizer fixtures.
Owner: Security and engineering

Payments and PCI boundary

External review

SEC-R-020

Question: Can live payment pages remain Stripe-hosted with no card data stored or logged by Otto?
Evidence: Stripe test payment, webhook, Connect settings, refund, and card-fee proofs are review inputs.
Owner: Payments reviewer and engineering

AI guardrails

Documented

SEC-R-015

Question: Are prompt-injection defenses, least-privilege tools, output validation, and AI kill switches ready for review?
Evidence: AI foundation, providers, tools, guardrails, minimization, retrieval, usage, and eval pages are local artifacts.
Owner: AI owner and security reviewer

Audit logging and incident response

Documented

SEC-R-030SEC-R-031SEC-R-040

Question: Can sensitive access be audited and can incidents be declared, communicated, and remediated?
Evidence: Audit log viewer, observability route, uptime health, and incident runbook proof are review inputs.
Owner: Security, operations, and engineering

Reviewer package

Evidence bundle is ready; external report is pending

docs/security/external-review-checklist.md

Architecture overview

Documented

Artifact: docs/prd/34-technical-architecture.md
Purpose: Explain hosting, tenancy, database, jobs, providers, and environments.

Security requirements

Documented

Artifact: docs/prd/36-security-requirements.md
Purpose: Map SEC-R-001 through SEC-R-040 into review scope.

CI and scanner gates

Documented

Artifact: .github/workflows/ci.yml
Purpose: Show typecheck, tests, format, build, secret scan, license scan, audit, seed, and RLS jobs.

Critical scenarios

Documented

Artifact: /hardening/critical-scenarios
Purpose: Show always-green PRD 43.2 scenarios and pilot launch blocker status.

Preview/staging plan

Documented

Artifact: docs/deployment/preview-staging.md
Purpose: Show environment boundaries, secret groups, staging blockers, and disabled production deployment actions.

Incident runbook

Documented

Artifact: /hardening/observability-incident
Purpose: Show structured logs, Sentry adapter shape, health endpoint, severity definitions, roles, and runbook cadence.

External review report

External review

Artifact: External reviewer deliverable
Purpose: Capture findings, severities, evidence, and retest notes.

Remediation lanes

High severity findings block pilot launch

External security review findings of high severity must be resolved before pilot launch.

Critical

CRITICAL

Target: Immediate fix or full production block
Pilot rule: Blocks pilot and paying-school launch.
Owner: Founder and engineering

High

HIGH

Target: Resolve before pilot launch
Pilot rule: External security review findings of high severity must be resolved before pilot launch.
Owner: Founder, engineering, and reviewer

Medium

MEDIUM

Target: Resolve before first paying school unless accepted with owner signoff
Pilot rule: May be accepted for pilot only with explicit owner risk decision.
Owner: Engineering and operations

Low

LOW

Target: Track with due date and regression coverage
Pilot rule: Does not block pilot unless repeated or tied to sensitive data.
Owner: Engineering

Remediation tracker

External review findings are tracked but not resolved here

3 pilot blockers

SEC-F-001 - External security reviewer

External auth, tenancy, and RLS review not complete

HIGHExternal review

Due target: Before first pilot
Evidence: SEC-R-002 requires external review of authentication, tenancy, and RLS foundations before pilot.
Blocks pilot: Yes

SEC-F-002 - Security and engineering

Live file malware scanning vendor not activated

HIGHNeeds remediation

Due target: Before production uploads
Evidence: File upload proof covers local fixtures; production malware scanning remains external setup.
Blocks pilot: Yes

SEC-F-003 - Payments reviewer

Live payment CSP and PCI SAQ-A packet not reviewed

HIGHExternal review

Due target: Before live payments
Evidence: SEC-R-020 requires Stripe-hosted fields, no card data in Otto, PCI SAQ-A, CSP, and script-integrity controls.
Blocks pilot: Yes

SEC-F-004 - Engineering

Preview/staging provider setup pending

MEDIUMNeeds remediation

Due target: Before external staging review
Evidence: Ticket 156 documents hosting and environment setup but does not create external environments.
Blocks pilot: No

SEC-F-005 - Founder

Penetration test scheduled before first paying school

MEDIUMAccepted later

Due target: Before first paying school
Evidence: SEC-R-002 requires a penetration test before the first paying school and annually after.
Blocks pilot: No

SEC-F-006 - Founder

SOC 2 and HECVAT are later sales readiness items

LOWDocumented

Due target: After first paying school timeline
Evidence: SEC-R-003 makes SOC 2 and HECVAT P1, not a local proof completion claim.
Blocks pilot: No

Signoff gates

Pilot security signoff stays blocked externally

5 gates

External reviewer selected

External review

Owner: Founder
Evidence: Reviewer selection is an external business action.

Scope package ready

Documented

Owner: Engineering
Evidence: Local package items and docs identify what the reviewer needs.

High findings resolved

Blocked externally

Owner: Founder and engineering
Evidence: External security review findings of high severity must be resolved before pilot launch.

Retest evidence captured

External review

Owner: External security reviewer
Evidence: External reviewer retest notes are required after remediation.

Pilot security signoff

Blocked externally

Owner: Founder
Evidence: Pilot launch stays blocked until external review blockers close.

External security review actions are disabled

Proof boundary

6 disabled