Controls (reference baseline)
- MFA enforced (Owner/Admin)Not started
- RLS enabled + tested on all tablesNot started
- Secure cookies / SameSite / PKCENot started
- Zod validation on all mutationsNot started
- Rate limiting (auth, webhooks, search)Not started
- Server-side API authorizationNot started
- Append-only audit loggingNot started
- Secret management (no committed secrets)Not started
- Backup verification (Supabase PITR)Not started
- Restore drill on stagingNot started
- Dependency scanning (Dependabot + npm audit)Not started
- Security headers (next.config + verify)Not started