# Security Test Plan

## Identity

- invalid signature, issuer, audience, expiry, not-before;
- revoked client and disabled project;
- dev token against prod alias;
- user session fixation, CSRF, logout, refresh expiry;
- duplicate and conflicting group/role bindings.

## Router

- unknown alias;
- encoded path traversal;
- oversized body;
- hop-by-hop header injection;
- attacker-supplied upstream host;
- authorization header logging test;
- timeout and partial-stream handling.

## Connectors

- path traversal and symlink escape;
- SSRF and redirect to disallowed address;
- output containing tokens, cookies, ANSI/control characters, and HTML;
- target resource from another project;
- pagination abuse and oversized output;
- malicious document prompt injection retained as data only.

## Docker broker

- every write/exec endpoint absent;
- raw API path denied;
- unregistered container denied;
- Docker label spoof resistance;
- bounded logs;
- socket unavailable degradation.

## Persistence and audit

- migration rollback/restore;
- sanitized arguments;
- audit cannot be modified through normal API;
- retention job does not delete within protected window;
- cache flush does not alter authorization truth.

## Supply chain

- lockfile integrity;
- exact container digests in release manifest;
- SBOM generated;
- secret scan clean;
- dependency and image scan policy enforced.


## WP-160 executable gates

`tests/test_wp160_security.py` covers prompt injection as data, secret-like content rejection, registered-root traversal, SSRF host literals, token-reference boundaries, gateway drift, Compose socket/public-port invariants, and SBOM contents. `scripts/security_scan.py` performs the deterministic source/Compose policy scan; `scripts/generate_sbom.py` emits a CycloneDX 1.5 inventory from locked Python/Node manifests and declared container images. Fixture-only findings are explicitly classified and do not become production evidence.