Commit c3ae8d

2026-03-14 22:20:30 Claude (MCP): [mcp] Link landing page spec from P4-6, add P4-8 security review task
Tasks/Phase_4.md ..
@@ 135,6 135,8 @@
**Description:**
Public landing page at `wikibot.io` for new visitors. Explains what wikibot.io is, shows pricing (free tier), and has a signup CTA. Basic docs covering: getting started, MCP setup, wiki conventions.
+ **Design spec:** [[Design/Landing_Page]] — content, structure, tone, logo requirements, deliverables.
+
**Deliverables:**
- Landing page (within SPA or separate static page)
- Getting Started guide
@@ 170,4 172,29 @@
- [ ] Rate limiting doesn't block normal usage
- [ ] Monitoring dashboard shows the test traffic
- [ ] Backup has run at least once
- - [ ] No security warnings in WAF logs from legitimate traffic
\ No newline at end of file
+ - [ ] No security warnings in WAF logs from legitimate traffic
+
+ ---
+
+ ### P4-8: Pre-Launch Security Review
+
+ **Parallel group:** Phase 4 (after P4-7, before launch)
+ **Dependencies:** P4-7 (E2E test — system must be functionally complete first)
+ **Target:** `wikibot-io` repo, `feat/P4-8-security`
+
+ **Description:**
+ Structured security review of the full attack surface before opening to users. Not a third-party pentest — a systematic walkthrough of auth, access control, input validation, infrastructure config, and data exposure. The full checklist is in [[Tasks/Launch_Checklist]] under "Security Review."
+
+ This is a gate: launch does not proceed until all security checklist items pass.
+
+ **Deliverables:**
+ - Security review results documented (Dev/P4-8_Security_Review)
+ - Any vulnerabilities found are filed as issues and fixed
+ - All items in Launch_Checklist "Security Review" section checked off
+
+ **Acceptance criteria:**
+ - [ ] All auth/access control checks pass (tenant isolation, token handling, ACL enforcement)
+ - [ ] All input validation checks pass (path traversal, XSS, injection, MCP fuzzing)
+ - [ ] All infrastructure checks pass (secrets management, EFS isolation, HTTPS, CORS, rate limiting)
+ - [ ] All data exposure checks pass (error responses, git isolation, search scoping, cache isolation)
+ - [ ] No unresolved high-severity findings
\ No newline at end of file
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9