Pre-launch security review before opening to users. This is not a penetration test — it's a structured walkthrough of the attack surface.

- [ ] Verify tenant isolation: User A cannot access User B's wiki via API, MCP, web UI, or git

- [ ] Verify MCP bearer tokens are hashed at rest (not stored in plaintext)

- [ ] Verify OAuth tokens are not logged or exposed in error responses

- [ ] Verify expired/revoked tokens are rejected promptly

- [ ] Verify ACL enforcement on all routes (API, MCP, web, git)

- [ ] Test collaborator invite flow: invited user gets correct permissions, uninvited user gets nothing

- [ ] Wiki names, page names, usernames: test for path traversal (`../`, `%2e%2e/`)

- [ ] Markdown content: test for stored XSS (script tags, event handlers, javascript: URIs in rendered HTML)

- [ ] API inputs: test for injection via page titles, search queries, tag values

- [ ] MCP tool inputs: fuzz all tool parameters for unexpected types and boundary values

- [ ] Lambda environment variables: no secrets in plaintext (use Secrets Manager or Pulumi config)

- [ ] EFS: confirm no cross-tenant file access is possible via path manipulation

- [ ] DynamoDB: confirm IAM policies scope Lambda access appropriately

- [ ] API Gateway: confirm rate limiting is active

- [ ] HTTPS enforced on all endpoints (no HTTP fallback)

- [ ] CORS headers: confirm only expected origins are allowed

- [ ] Error responses do not leak stack traces, file paths, or internal identifiers

- [ ] Git clone does not expose other tenants' repos

- [ ] Search (keyword and semantic) is scoped to the requesting user's wikis only

- [ ] CloudFront cache does not serve User A's cached content to User B