Run security, conformance, and performance assurance

[4nass]

Goal

Find failures that unit tests and local flows do not show.

Scope

• Run dependency and vulnerability checks.
• Run fuzzing for cookie, header, query, and response parsing.
• Run concurrent login, switch, refresh, and logout tests.
• Run load tests with several proxy replicas.
• Test upstream timeouts, connection failures, malformed responses, and restarts.
• Review cookie fixation, CSRF, XSS, replay, and session leakage risks.
• Record findings and remediation decisions.

Done when

• A repeatable assurance job runs in CI or a controlled environment.
• Performance limits and expected capacity are documented.
• High-risk findings are fixed or explicitly accepted by maintainers.
• A security review report is stored without secrets or personal data.