# OrgHub — Penetration Test Checklist

> **Status:** Template for external security audit before production sign-off.  
> **Owner:** Platform super-admin + DPO (`dpo@orghub.gr`)

## Scope

- Static PWA (`orghub.gr`) + Supabase backend (RLS, Edge Functions)
- GDPR controls: consent, erasure, DSAR, retention, breach register
- Wearables OAuth (Garmin, COROS)

## Pre-requisites for auditor

1. Staging or production-like environment with test orgs
2. Test accounts: super-admin, org owner, admin, member, coach, athlete
3. Supabase service role key **not** shared — test via authenticated clients only
4. Written authorization (rules of engagement)

## Test matrix

| Area | Tests | Pass criteria |
|------|-------|---------------|
| Auth | Login brute-force, MFA bypass, session hijack | No unauthorized access |
| RLS | Cross-org reads/writes on all major tables | 0 cross-tenant leaks |
| GDPR | Erasure completeness, DSAR export, DPA gate | Art. 15–17 verified |
| Wearables | Connect without `health_data` consent | Blocked at API + RLS |
| Edge fn | `gdpr-erasure`, `gdpr-retention`, `send-email` | Auth enforced |
| Headers | CSP, HSTS, clickjacking | A rating on securityheaders.com |

## Deliverables

- [ ] Executive summary (Greek or English)
- [ ] Findings ranked Critical / High / Medium / Low
- [ ] Remediation timeline
- [ ] Re-test confirmation after fixes

## Sign-off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| External auditor | | | |
| DPO | | | |
| Platform owner | | | |

## Related docs

- `pentest.html` — public checklist summary
- `compliance.html` — Compliance Hub
- `security.html` — technical measures