ProxyWarden/.agent/checklists/security.md

Security Checklist

Secrets

• Subscription URLs are redacted through parser-based logic.
• Proxy credentials are not logged.
• Outbound configs with secrets are not printed in diagnostics.
• Error messages do not include tokens/passwords/userinfo.

Tauri/webview

• CSP is enabled.
• No broad shell permissions added.
• No direct command execution from UI input.
• No dangerouslySetInnerHTML or equivalent unsafe HTML rendering without sanitization.

Network fetch

• Subscription fetch has timeout.
• URL scheme is restricted.
• Local/private/link-local/metadata address behavior is explicit.
• Redirect behavior does not bypass blocked address checks.

Filesystem

• Critical writes are atomic where practical.
• Corrupt config handling does not silently discard user state.
• Recursive delete has strict path/marker checks.
• Temp elevated scripts use unpredictable names and safe directory/ACL when practical.

Windows services

• Managed service is verified by name and PathName/metadata.
• Fuzzy candidates are not automatically controlled.
• UAC cancellation has clear error.
• Plan-only remains side-effect-free.