Security checklist
Authn / authz
- Authentication check happens on a path the caller can't influence (verified JWT, session cookie with
HttpOnly/Secure/SameSite). - Authorization is explicit in the handler, not implied by routing.
- Role/permission decisions use the server's identity model, never a client-supplied header.
- Multi-tenant check: the resource belongs to the caller's tenant (not just the caller's user).
- No IDOR: object IDs in URLs are checked agains
[Description truncada. Veja o README completo no GitHub.]