#!/usr/bin/env python3
"""
Security Checklist Generator — Zero Token Policy.

Usage:
    python checklist_gen.py > security_gate.md
"""

CHECKLIST_TEMPLATE = """# 🛡️ Security Release Gate (Pre-Flight)

## 1. Authentication & Authorization (AuthN/AuthZ)
- [ ] **Standard Libs Only**: Are we using NextAuth / Passport / Firebase? (No custom auth code).
- [ ] **RBAC Check**: Are API endpoints protected by role guards?
- [ ] **Session Mgmt**: Complete logout implemented (Cookie clearing)?

## 2. Data Protection (Encryption)
- [ ] **At Rest**: Database volumes encrypted?
- [ ] **In Transit**: HTTPS enforced everywhere?
- [ ] **Passwords**: Hashed with `bcrypt` or `argon2` (No MD5/SHA1)?
- [ ] **Sensitive Data**: PII (Emails, Phones) excluded from logs?

## 3. OWASP Top 10 (Quick Scan)
- [ ] **Injection**: No raw SQL queries? (Used ORM/Prisma).
- [ ] **XSS**: No `dangerouslySetInnerHTML` or `v-html` without sanitation?
- [ ] **Broken Access**: Can User A access User B's data? (IDOR check).

## 4. Architecture & Threat Model
- [ ] **Attack Surface**: Are public endpoints minimized?
- [ ] **Rate Limiting**: Is DoS protection enabled (e.g., Redis rate limit)?
- [ ] **Dependencies**: `npm audit` / `pip audit` passed with 0 criticals?

## 5. Monitoring & Incident Response
- [ ] **Logs**: Structured JSON logs enabled?
- [ ] **Alerts**: Error rate > 1% triggers Sentry/PagerDuty?
- [ ] **Runbook**: Do we know who to call if DB leaks?

## 6. Final Review
- [ ] **Security Scan**: `python vuln_scan.py` returns clean?
- [ ] **Secret Scan**: No `.env` files committed to Git?

---
*Generated by Vibe Coding Security Skill*
"""

def main():
    print(CHECKLIST_TEMPLATE)

if __name__ == "__main__":
    main()
