Skip to content

Production Security Checklist

Complete this checklist before deploying SAWABONA to production.

Pre-Deployment Checklist

Secrets & Configuration

  • [ ] All secrets rotated from defaults
  • [ ] JWT secret >= 64 characters
  • [ ] Admin API key >= 32 characters
  • [ ] Encryption keys generated and configured
  • [ ] Payment provider keys configured (if enabled)
  • [ ] Database credentials set (not default)
  • [ ] Secrets backend configured (AWS/Azure, not env)
  • [ ] No hardcoded secrets in code or config files

Environment Settings

  • [ ] SAWABONA_ENVIRONMENT=production
  • [ ] SAWABONA_DEBUG=false
  • [ ] SAWABONA_SECURITY_HSTS_ENABLED=true (auto-enabled)
  • [ ] SAWABONA_LOGGING__LEVEL=INFO (not DEBUG)
  • [ ] SAWABONA_WORKERS set appropriately for load

Database Security

  • [ ] PostgreSQL configured and accessible
  • [ ] Database encryption enabled (pgcrypto)
  • [ ] SSL/TLS connection configured
  • [ ] Database backups configured and tested
  • [ ] Backup encryption enabled
  • [ ] Database credentials in secrets manager

Cryptographic Security

  • [ ] HSM configured (Cloud KMS or dedicated HSM)
  • [ ] Master keys stored in HSM (not filesystem)
  • [ ] Key rotation enabled (90-day cycle)
  • [ ] Ed25519 keys generated and configured
  • [ ] Encryption at rest enabled
  • [ ] Encryption audit logging enabled
  • [ ] Key rotation audit trail configured
  • [ ] Encryption key backup procedures documented

Network & Access Control

  • [ ] CORS origins restricted (no wildcards)
  • [ ] Trusted hosts configured
  • [ ] Rate limiting enabled
  • [ ] Rate limits appropriate for endpoints
  • [ ] Firewall rules configured
  • [ ] VPN/Bastion host for admin access

Security Headers

  • [ ] HSTS enabled (auto-enabled in production)
  • [ ] CSP header configured
  • [ ] X-Frame-Options set to DENY
  • [ ] X-Content-Type-Options set to nosniff
  • [ ] Referrer-Policy configured
  • [ ] Permissions-Policy configured (if needed)

Security Scanning

Code Security

  • [ ] Bandit scan passed (no HIGH/CRITICAL issues)
  • [ ] Safety check passed (no vulnerable dependencies)
  • [ ] pip-audit passed
  • [ ] Semgrep scan passed
  • [ ] CodeQL analysis passed

Dependency Security

  • [ ] npm audit passed (dashboard)
  • [ ] All dependencies up-to-date
  • [ ] No deprecated packages
  • [ ] License compliance verified

Container Security

  • [ ] Trivy scan passed (Docker image)
  • [ ] No HIGH/CRITICAL vulnerabilities
  • [ ] Multi-stage build used
  • [ ] Non-root user in container
  • [ ] Read-only filesystem where possible

Secret Scanning

  • [ ] detect-secrets baseline clean
  • [ ] No secrets in git history
  • [ ] Pre-commit hooks installed
  • [ ] Push protection enabled

Testing

Functional Testing

  • [ ] All unit tests passed
  • [ ] All integration tests passed
  • [ ] All E2E tests passed
  • [ ] Smoke tests passed
  • [ ] Performance tests passed

Security Testing

  • [ ] Authentication tests passed
  • [ ] Authorization tests passed
  • [ ] Input validation tests passed
  • [ ] Rate limiting tests passed
  • [ ] Encryption tests passed
  • [ ] Audit logging tests passed

Documentation

Security Documentation

  • [ ] SECURITY.md reviewed and current
  • [ ] THREAT-MODEL.md reviewed
  • [ ] An incident procedure exists for this deployment, and names who is on call and how a compromised signing key is rotated
  • [ ] OPEN-SOURCE-SECURITY.md reviewed
  • [ ] ROLLBACK_PROCEDURES.md tested

Operational Documentation

  • [ ] Deployment runbooks updated
  • [ ] Incident response procedures documented
  • [ ] Backup/restore procedures documented
  • [ ] Monitoring and alerting documented
  • [ ] Escalation procedures documented

Monitoring & Alerting

Logging

  • [ ] Audit logging enabled
  • [ ] Security events logged
  • [ ] Log aggregation configured
  • [ ] Log retention policy set
  • [ ] Logs encrypted at rest

Monitoring

  • [ ] Security monitoring configured
  • [ ] Anomaly detection enabled
  • [ ] Rate limit monitoring enabled
  • [ ] Failed authentication monitoring
  • [ ] Unauthorized access monitoring
  • [ ] Encryption operation monitoring enabled
  • [ ] Key rotation progress monitoring enabled
  • [ ] Encryption audit log monitoring enabled

Alerting

  • [ ] Alert channels configured (email, Slack, PagerDuty)
  • [ ] Critical alerts configured
  • [ ] On-call rotation established
  • [ ] Alert response procedures documented
  • [ ] Alert testing completed

Post-Deployment Verification

Health Checks

  • [ ] Health endpoint responding
  • [ ] All services healthy
  • [ ] Database connectivity verified
  • [ ] Redis connectivity verified (required when [challenge.storage] backend = "redis", when SAAS_OIDC_ENABLED=true, or when revocation cache is enabled)
  • [ ] External services accessible

Security Verification

  • [ ] HSTS header present
  • [ ] CSP header present
  • [ ] Security headers validated
  • [ ] Rate limiting enforced
  • [ ] Authentication working
  • [ ] License validation working
  • [ ] Payment webhooks accessible

Functional Verification

  • [ ] Dashboard accessible
  • [ ] API endpoints responding
  • [ ] License validation working
  • [ ] Payment processing working
  • [ ] Audit logging working
  • [ ] No errors in logs

Incident Response Readiness

Team Preparation

  • [ ] Incident response team identified
  • [ ] Contact information updated
  • [ ] On-call schedule established
  • [ ] Escalation procedures documented

Procedure Testing

  • [ ] Runbooks tested
  • [ ] Backup/restore procedures tested
  • [ ] Rollback procedures tested
  • [ ] Incident communication templates prepared

Automated Verification

Run these commands before deployment:

# Validate secrets
make validate-secrets --strict

# Run all security checks
make security

# Run security scanning
make security-scan
make security-deps
make dashboard-security-scan

# Verify production security (configuration + live endpoint checks)
make verify-production-security

# Verify against a specific service URL
python scripts/verify_production_security.py --base-url https://api.example.com

# For CI/CD without running service, skip live checks:
python scripts/verify_production_security.py --skip-live

# Run smoke tests
make smoke-tests

# Deploy with all checks
make deploy-prod

Script Capabilities:

The verify-production-security script performs comprehensive security validation:

  1. Configuration Checks (always run):

  2. Environment variables (ENVIRONMENT=production, DEBUG=false)

  3. Secrets configuration (JWT, API keys, encryption keys)
  4. Security headers configuration (HSTS, CSP, etc.)
  5. Database security (PostgreSQL, encryption)
  6. Rate limiting enabled

  7. CORS configuration

  8. Live Endpoint Verification (requires running service, unless --skip-live):

  9. HTTP Security Headers: Validates HSTS, CSP, X-Frame-Options=DENY, X-Content-Type-Options=nosniff
  10. HTTP Rate Limiting: Sends rapid requests and verifies 429 response
  11. Service health check passing

CLI Options:

  • --base-url URL: Base URL of the running service (default: http://localhost:8000)
  • --skip-live: Skip live endpoint verification (for CI/CD without running service)
  • --json: Output results in JSON format

Sign-Off

  • [ ] Security Lead: ****_**** Date: ___
  • [ ] Operations Lead: ****_**** Date: ___
  • [ ] Engineering Lead: ****_**** Date: ___

Last Updated: 2025-12-04 Version: 1.0