Security Testing
Security Testing
Record security verification practices and evidence.
Status: Partial implementation reference — Code-confirmed; operational validation pending
Last reviewed: 2026-10-19
Scope
Threat-driven cases, access controls, input validation, execution guidance and unresolved gaps. The source-confirmed baseline below covers part of this scope; remaining operational details are unknown.
Current implementation baseline
Source tests cover credential/endpoint assignment, public credential exclusion, spoofed attribution rejection, OAuth scope enforcement, relationship authority, schema/input rejection and selected failure paths. Use the linked Worker test specifications to distinguish existing declarations from proposed scenarios and execution evidence.
Evidence includes Registration credential tests, Ingress auth tests, Corpus authority tests and MCP scope tests. These were inspected, not executed for this audit.
Open items include deployment access controls, MCP test-route exposure, complete logging/redaction review and provider credential/retention validation. A source test does not establish production security or universal input safety; see trust boundaries.
