Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

docs/02-security/SECURITY_TEST_PLAN.md

@@ -0,0 +1,58 @@
+# Security Test Plan
+
+## Identity
+
+- invalid signature, issuer, audience, expiry, not-before;
+- revoked client and disabled project;
+- dev token against prod alias;
+- user session fixation, CSRF, logout, refresh expiry;
+- duplicate and conflicting group/role bindings.
+
+## Router
+
+- unknown alias;
+- encoded path traversal;
+- oversized body;
+- hop-by-hop header injection;
+- attacker-supplied upstream host;
+- authorization header logging test;
+- timeout and partial-stream handling.
+
+## Connectors
+
+- path traversal and symlink escape;
+- SSRF and redirect to disallowed address;
+- output containing tokens, cookies, ANSI/control characters, and HTML;
+- target resource from another project;
+- pagination abuse and oversized output;
+- malicious document prompt injection retained as data only.
+
+## Docker broker
+
+- every write/exec endpoint absent;
+- raw API path denied;
+- unregistered container denied;
+- Docker label spoof resistance;
+- bounded logs;
+- socket unavailable degradation.
+
+## Persistence and audit
+
+- migration rollback/restore;
+- sanitized arguments;
+- audit cannot be modified through normal API;
+- retention job does not delete within protected window;
+- cache flush does not alter authorization truth.
+
+## Supply chain
+
+- lockfile integrity;
+- exact container digests in release manifest;
+- SBOM generated;
+- secret scan clean;
+- dependency and image scan policy enforced.
+
+
+## WP-160 executable gates
+
+`tests/test_wp160_security.py` covers prompt injection as data, secret-like content rejection, registered-root traversal, SSRF host literals, token-reference boundaries, gateway drift, Compose socket/public-port invariants, and SBOM contents. `scripts/security_scan.py` performs the deterministic source/Compose policy scan; `scripts/generate_sbom.py` emits a CycloneDX 1.5 inventory from locked Python/Node manifests and declared container images. Fixture-only findings are explicitly classified and do not become production evidence.