Penetration Test Checklist
Πρότυπο για εξωτερικό security audit πριν production sign-off. Δείτε επίσης PENTEST-CHECKLIST.md στο repo.
⚠️ Απαιτείται εξωτερικός auditor — όχι αυτο-πιστοποίηση1. Authentication & Session
- Brute-force / rate limiting στο login
- TOTP 2FA enrollment & unenroll flows
- Session fixation, logout, token expiry
- Password reset email enumeration
2. Authorization & RLS
- Cross-tenant data access (org A → org B)
- Role escalation (member → admin)
- Super-admin boundary tests
- RLS bypass via direct Supabase API
- Wearable connections without health_data consent
3. GDPR & Privacy
- DSAR export completeness (Art. 15)
- Cascade erasure verification (Art. 17)
- DPA gate for org owners
- Minors <16 parental consent flow
- Retention job (6mo audit / 3yr breaches)
4. Edge Functions & API
- gdpr-erasure, gdpr-retention auth boundaries
- wearable-oauth consent enforcement
- send-email open relay prevention
- Stripe webhook signature validation
5. Frontend & Headers
- CSP, HSTS, X-Frame-Options (vercel.json)
- XSS σε user-generated content
- Service worker cache poisoning
Επικοινωνία DPO: dpo@orghub.gr