Handbook
Security and accessibility hardening (17)
Updated
Required regression tests
forge360/tests/test_security_regression.py— tenant isolation, PDP gates- Private key not in query strings (export POST only)
- XSS surfaces: people names, comment fields, report HTML
Accessibility
- WCAG 2.2 AA target per
.cursor/rules/030-accessibility-responsive-and-i18n.mdc - Keyboard: sign-in, survey, results, admin tables
- Chart text alternatives on competency reports
Observability
- Structured logs without envelope plaintext or keys
- Mock Lab orchestration checks:
check-600,check-920,check-1020,check-mock-lab