# Security review checklist (P7.QA.03)

- [ ] OWASP Top 10 spot checks
- [ ] IDOR matrix: order/quote/customer IDs
- [ ] Upload: MIME/size/path traversal
- [ ] Secrets: no .env in repo; CI scrubbed
- [ ] RBAC SoD: bank change ≠ payment release
- [ ] Critical/High open = 0