Security Checklist

Identity and Access

• Authentication is required.
• Authorization is enforced server-side.
• Least privilege is applied.
• Service accounts have minimal permissions.
• Privileged actions are logged.

Secrets

• Secrets are stored in a secret manager or environment system.
• Secrets are not committed.
• Rotation plan exists.
• Local development secrets are separated.

Data Protection

• Sensitive data is classified.
• Encryption in transit is used.
• Encryption at rest is used where appropriate.
• Data retention is documented.
• Data deletion process is documented.

AI-Specific Security

• Prompt injection is tested.
• Retrieval poisoning is considered.
• Tool abuse is tested.
• Output handling is validated.
• Sensitive data leakage tests exist.

Audit and Monitoring

• Security events are logged.
• Access logs are retained.
• Alerting exists for suspicious behavior.
• Incident response notes exist.